# ClickLock Stealer: ClickFix-Delivered macOS Infostealer with GSocket Reverse-Shell Backdoor

> ClickLock Stealer is a modular macOS infostealer distributed via ClickFix-style phishing pages spoofing a Cloudflare CAPTCHA that trick victims into pasting a Terminal command. It harvests the macOS login password, Chrome Safe Storage keys, data from 8 browsers, credentials from 31 Chromium and 7 Firefox crypto wallet extensions, 8 desktop wallets, and 7 password manager extensions, and installs a GSocket-based reverse-shell backdoor for persistent remote access.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1402
- **ID:** TL-2026-1402
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** ClickLock Dev
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ClickLock Stealer is a modular, multi-stage macOS infostealer attributed to the actor tracked as 'ClickLock Dev' by Group-IB. Discovered on VirusTotal on June 9, 2026 with zero detections, the campaign has been active since approximately May 2026 and has compromised at least 100 victims across 33 countries, with over half concentrated in Europe and secondary concentration in North America and the Middle East/Africa.

Initial access uses the ClickFix social-engineering technique: victims land on phishing pages impersonating a Cloudflare 'CAPTCHA ACCESS CONTROL' verification banner (as well as spoofed Claude and disk-cleaner utility pages) that instruct them to open Terminal and paste a single command. That command downloads and executes an orchestrator shell script (script.sh) which disables keyboard interrupts (trap INT), hides the terminal cursor, and displays a fake progress animation while it sequentially downloads and runs four further modules, all hosted on compromised WordPress sites (panalobet[.]ph, store.grafsynergy[.]com) or staging infrastructure (cottonbox[.]co[.]il).

The orchestrator installs LaunchAgent persistence (com.authirity.plist, com.chromer.plist), fingerprints the host (username, macOS version, CPU, RAM, disk, public IP via ifconfig.me), and kills NotificationCenter for roughly six hours to suppress macOS security prompts.

The credential-theft chain has two escalating components. chromer.txt (the Keychain Stealer) queries the macOS Keychain via `security find-generic-password` to steal the Chrome Safe Storage AES key, and runs an aggressive kill-loop terminating Finder, Dock, SystemUIServer, browsers, Terminal, and Activity Monitor every 0.2 seconds for up to 34.7 days to coerce the user into granting Keychain access through attrition. zsh.txt (the Credential Stealer) creates a hidden staging directory ~/.cacheb/, downloads a spoofed Apple icon from store.grafsynergy[.]com/media/apple.png, and displays a fake osascript password dialog; refusal escalates to a kill-loop firing every 210ms for up to ~83 hours. Entered passwords are validated in real time against `dscl /Local/Default -authonly` and logged in plaintext, hex, and base64 before exfiltration via the Telegram Bot API with up to 1,000 retry attempts. Both components apply timestamp forgery (copying mtimes from ~/Movies) after each action to blind forensic timelines, and self-delete via `rm -- "$0"` on completion.

The crypto/browser stealer module (finderv2.jpg, executed as finder.sh piped directly to bash without touching disk) performs comprehensive extraction across 8 browsers (Chrome, Brave, Edge, Opera, Vivaldi, Arc, Chromium, Firefox), 31 Chromium-based crypto wallet extensions (including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, Rainbow, Exodus, Keplr, Solflare, OKX Wallet, Backpack, Yoroi, Tonkeeper, Xverse, UniSat, Ronin, TronLink, Zerion, MyTonWallet, Bitget, Leather, Bittensor), 7 Firefox wallet extensions (MetaMask, Phantom, Ronin Wallet, Alby, FilSnap, Tonkeeper, Solflare), 8 desktop wallets (Exodus, Coinomi, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Feather/Monero, and a listed '1Password' entry), and 7 password manager extensions (Bitwarden, LastPass, Talisman, 1Password, iCloud Passwords, NordPass, Keeper, with Dashlane and Enkrypt also referenced). It extracts blockchain addresses across 6 chains (EVM, Bitcoin, Solana, TRON, TON, Stacks) using the plyvel Python library to parse Snappy-compressed LevelDB blocks, with a proximity-based regex fallback that reassembles encrypted vault components (data/iv/salt) within a 1000-byte window for offline brute-forcing, dispatched through wallet-specific parsers. It also harvests shell history and FileZilla FTP credentials.

The final component (goyim) deploys a GSocket-based backdoor built on a customized version of the legitimate open-source gsocket deploy.sh installer (reusing an estimated 70-80% of the original code). It detects OS/architecture, downloads a precompiled gs-netcat binary from gsocket.io/bin, and on macOS disguises the binary as 'iCloud' inside ~/Library/Application Support/iCloudsync while masquerading its running process as 'SystemUIServerl'. Persistence is layered across crontab injection, shell RC file modification (.bashrc/.zshrc), and a LaunchAgent — and unlike every other component, it does not self-delete. It connects to the GSocket relay gsnc[.]eu:67 for an AES-encrypted PTY reverse shell and sends host reconnaissance (username, OS, CPU, RAM, external IP) plus an initial connection secret through three redundant channels: HTTP webhook, Telegram bot, and DNS.

ClickLock requires no exploits or elevated privileges to operate, relying entirely on social engineering and TCC-permission attrition. Its dual-mode approach (soft persuasion escalating to a hard kill-loop denial-of-service against the user's own desktop) and extensive timestamp forgery make it notably resistant to both user refusal and post-incident forensic analysis.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1584.001 Domains
- T1587 Develop Capabilities
- T1587.001 Malware
- T1588.002 Tool
- T1608.001 Upload Malware
- T1608.002 Upload Tool
- T1189 Drive-by Compromise
- T1059.002 AppleScript
- T1059.004 Unix Shell
- T1204 User Execution
- T1204.004 Malicious Copy and Paste
- T1543.001 Launch Agent
- T1543 Create or Modify System Process
- T1543.001 Launch Agent
- T1027 Obfuscated Files or Information
- T1027.016 Junk Code Insertion
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1036.008 Masquerade File Type
- T1070 Indicator Removal
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1070.009 Clear Persistence
- T1564 Hide Artifacts
- T1564.001 Hidden Files and Directories
- T1564.003 Hidden Window
- T1685 Disable or Modify Tools
- T1056.002 GUI Input Capture
- T1187 Forced Authentication
- T1528 Steal Application Access Token
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1552.003 Shell History
- T1555 Credentials from Password Stores
- T1555.001 Keychain
- T1555.005 Password Managers

## Sources

- [ClickLock Stealer macOS malware analysis](https://www.group-ib.com/blog/clicklock-stealer-macos-malware/)
- [GitHub - hackerschoice/gsocket: Connect like there is no firewall. Securely.](https://github.com/hackerschoice/gsocket)
- [GSocket Backdoor via Bash Script on Linux and macOS](https://socprime.com/active-threats/gsocket-backdoor-analysis/)
- [GSocket Backdoor Delivered Through Bash Script](https://isc.sans.edu/diary/32816)
- [New macOS ClickFix attack silently mounts DMGs to push infostealer](https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/)
- [Evil evolution: ClickFix and macOS infostealers](https://www.sophos.com/en-us/blog/evil-evolution-clickfix-and-macos-infostealers)
- [ClickFix Campaigns Targeting Windows and macOS](https://www.recordedfuture.com/research/clickfix-campaigns-targeting-windows-and-macos)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [Invisible Reverse Shells: How gsocket Backdoors Hide in Plain Sight](https://kbourdakos.gr/articles/invisible-reverse-shells-how-gsocket-backdoors-hide-in-plain-sight.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1402