ClickLock: New macOS Infostealer Uses ClickFix Lure and App-Killing LaunchAgents to Force Credential Entry — Threadlinqs Intelligence
As of 2026-07-16, ClickLock: New macOS Infostealer Uses ClickFix Lure and App-Killing LaunchAgents to Force Credential Entry is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-1421 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
ClickLock is a macOS infostealer distributed via a ClickFix-style Terminal-paste lure hidden behind a fake Cloudflare CAPTCHA. Victims who refuse a fraudulent Apple password prompt have Finder, Dock,
ClickLock is delivered through a ClickFix-style social-engineering lure: a compromised or attacker-controlled webpage presents a fake, non-functional Cloudflare CAPTCHA with a cycling ten-second progress bar, then instructs the victim to paste and execute a Terminal command. The pasted command runs an orchestrator script (script.sh) that disables keyboard interrupts (SIGINT), hides the cursor, and retrieves four additional payloads from attacker-controlled hosts — two piped directly into bash and two written to a hidden staging directory at $HOME/.cacheb/.
Once staged, the malware displays a fake Apple system dialog (rendered via osascript, using icons staged in /tmp/) that is populated with the victim's real macOS username to increase credibility, prompting for the account password. Every submitted password is validated locally against `dscl /Local/Default -authonly` (or `dscl . -authonly <user>` in related campaigns) before being accepted, guaranteeing that only working credentials are exfiltrated and that failed attempts are rejected and re-prompted.
The defining coercion technique is app-killing persistence: two LaunchAgents are installed under ~/Library/LaunchAgents/ — com.authirity.plist runs 210-millisecond kill loops against Finder, Dock, Spotlight, Terminal, Activity Monitor, and installed browsers, and com.chromer.plist runs equivalent kill cycles at 0.2-second intervals for up to 3,000,000 seconds (~34.7 days), continuously terminating the victim's workflow until the password prompt is satisfied. A third loop kills NotificationCenter for six hours to suppress Gatekeeper and system security warnings during the compromise window. If Terminal lacks Full Disk Access, the malware walks the victim through an automated System Settings flow to grant it.
Upon successful credential validation, ClickLock harvests: the macOS login password; Chrome's Safe Storage AES decryption key (enabling offline decryption of exfiltrated Login Data/Cookies databases); browser saved credentials, cookies, and autofill data; cryptocurrency wallet browser-extension storage and desktop wallet application files; password manager vaults; Keychain contents (via `security find-generic-password` and related Keychain APIs); shell history; and FileZilla stored server credentials. Exfiltration is routed through Telegram bots (api.telegram.org traffic following bulk browser-profile reads).
For persistence, ClickLock installs 'goyim,' a modified reverse-shell component that replicates roughly 80% of the public gs-netcat deploy script from The Hacker's Choice's open-source GSocket toolkit. The backdoor requires no dedicated C2 infrastructure of its own — it authenticates with a shared secret to the Global Socket Relay Network (GSRN) via the operator relay gsnc.eu:67, giving the operator an encrypted, NAT/firewall-traversing reverse shell that the relay itself cannot decrypt. The binary is dropped as 'iCloud' inside ~/Library/Application Support/iCloudsync/ and executes under the process name SystemUIServerl — a single character removed from the legitimate macOS SystemUIServer process, a lightweight masquerade intended to blend into Activity Monitor.
Group-IB (report: 'ClickLock Stealer: Paste Once, Lose Everything,' published 2026-07-16) documented at least 100 victims across 33 countries since May 2026, with over 50% concentrated in Europe, and additional targeting reported across North America and the Middle East/Africa. A ClickLock sample uploaded to VirusTotal on 2026-06-09 recorded zero antivirus detections at the time. The campaign began in May 2026, roughly one month after Apple shipped Terminal paste-warning protections in macOS 26.4 (March 2026), placing it within a broader wave of ClickFix-style macOS campaigns (Microsoft's SHub Stealer reporting, May 2026; Jamf's April 2026 applescript:// Script Editor variant delivering Atomic Stealer; ongoing AMOS/Atomic macOS Stealer and MacSync activity) that are actively adapting ClickFix delivery to ro
Weaknesses (CWE)
CWE-451, CWE-506, CWE-522, CWE-798
Target sectors: individual users, consumer, finance, cryptocurrency
Target regions: Europe, North America, Middle East, Africa
Detections & IOCs
As of 2026-08-10, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1204, T1059, T1543, T1546, T1543, T1036, T1685, T1070, T1564
