ClickLock: New macOS Infostealer Uses ClickFix Lure and App-Killing LaunchAgents to Force Credential Entry

ClickLock: New macOS Infostealer Uses ClickFix Lure and (TL-2026-1421), also tracked as ClickLock, is a high-severity malware campaign, first published 2026-07-16. It has no confirmed attribution, affects Apple macOS, maps to 28 MITRE ATT&CK techniques (T1005, T1033, T1036), and is covered by 9 detection rules and 25 indicators of compromise.

Key facts for TL-2026-1421

Threat ID
TL-2026-1421
Also known as
ClickLock, ClickLock Stealer, goyim
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-16
Last reviewed
2026-07-16
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
individual users, consumer, finance, cryptocurrency
Target regions
Europe, North America, Middle East, Africa
Detection rules
9
Indicators of compromise
25

Malware and tooling in ClickLock: New macOS Infostealer Uses ClickFix Lure and

Malware and tooling: AMOS, ClickLock, MacSync Stealer, SHub Stealer, goyim, GSocket / gs-netcat

ClickLock is a macOS infostealer distributed via a ClickFix-style Terminal-paste lure hidden behind a fake Cloudflare CAPTCHA. Victims who refuse a fraudulent Apple password prompt have Finder, Dock, Spotlight, Terminal, Activity Monitor, and browsers repeatedly killed by malicious LaunchAgents until they comply, after which the malware harvests the macOS login password, Keychain, browser Safe Storage keys, crypto wallets, password manager vaults, and shell history, and installs a modified GSocket ('goyim') reverse-shell backdoor for persistent access.

How ClickLock: New macOS Infostealer Uses ClickFix Lure and works

ClickLock is delivered through a ClickFix-style social-engineering lure: a compromised or attacker-controlled webpage presents a fake, non-functional Cloudflare CAPTCHA with a cycling ten-second progress bar, then instructs the victim to paste and execute a Terminal command. The pasted command runs an orchestrator script (script.sh) that disables keyboard interrupts (SIGINT), hides the cursor, and retrieves four additional payloads from attacker-controlled hosts — two piped directly into bash and two written to a hidden staging directory at $HOME/.cacheb/.

Once staged, the malware displays a fake Apple system dialog (rendered via osascript, using icons staged in /tmp/) that is populated with the victim's real macOS username to increase credibility, prompting for the account password. Every submitted password is validated locally against `dscl /Local/Default -authonly` (or `dscl . -authonly <user>` in related campaigns) before being accepted, guaranteeing that only working credentials are exfiltrated and that failed attempts are rejected and re-prompted.

The defining coercion technique is app-killing persistence: two LaunchAgents are installed under ~/Library/LaunchAgents/ — com.authirity.plist runs 210-millisecond kill loops against Finder, Dock, Spotlight, Terminal, Activity Monitor, and installed browsers, and com.chromer.plist runs equivalent kill cycles at 0.2-second intervals for up to 3,000,000 seconds (~34.7 days), continuously terminating the victim's workflow until the password prompt is satisfied. A third loop kills NotificationCenter for six hours to suppress Gatekeeper and system security warnings during the compromise window. If Terminal lacks Full Disk Access, the malware walks the victim through an automated System Settings flow to grant it.

Upon successful credential validation, ClickLock harvests: the macOS login password; Chrome's Safe Storage AES decryption key (enabling offline decryption of exfiltrated Login Data/Cookies databases); browser saved credentials, cookies, and autofill data; cryptocurrency wallet browser-extension storage and desktop wallet application files; password manager vaults; Keychain contents (via `security find-generic-password` and related Keychain APIs); shell history; and FileZilla stored server credentials. Exfiltration is routed through Telegram bots (api.telegram.org traffic following bulk browser-profile reads).

For persistence, ClickLock installs 'goyim,' a modified reverse-shell component that replicates roughly 80% of the public gs-netcat deploy script from The Hacker's Choice's open-source GSocket toolkit. The backdoor requires no dedicated C2 infrastructure of its own — it authenticates with a shared secret to the Global Socket Relay Network (GSRN) via the operator relay gsnc.eu:67, giving the operator an encrypted, NAT/firewall-traversing reverse shell that the relay itself cannot decrypt. The binary is dropped as 'iCloud' inside ~/Library/Application Support/iCloudsync/ and executes under the process name SystemUIServerl — a single character removed from the legitimate macOS SystemUIServer process, a lightweight masquerade intended to blend into Activity Monitor.

Group-IB (report: 'ClickLock Stealer: Paste Once, Lose Everything,' published 2026-07-16) documented at least 100 victims across 33 countries since May 2026, with over 50% concentrated in Europe, and additional targeting reported across North America and the Middle East/Africa. A ClickLock sample uploaded to VirusTotal on 2026-06-09 recorded zero antivirus detections at the time. The campaign began in May 2026, roughly one month after Apple shipped Terminal paste-warning protections in macOS 26.4 (March 2026), placing it within a broader wave of ClickFix-style macOS campaigns (Microsoft's SHub Stealer reporting, May 2026; Jamf's April 2026 applescript:// Script Editor variant delivering Atomic Stealer; ongoing AMOS/Atomic macOS Stealer and MacSync activity) that are actively adapting ClickFix delivery to route around Apple's new Terminal-side mitigations.

MITRE ATT&CK techniques used in TL-2026-1421

Collection

T1005 Data from Local System; T1074 Data Staged

Discovery

T1033 System Owner/User Discovery; T1518 Software Discovery

Defense Evasion

T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Credential Access

T1056 Input Capture; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Impact

T1499 Endpoint Denial of Service; T1657 Financial Theft

Persistence

T1543 Create or Modify System Process; T1546 Event Triggered Execution

Privilege Escalation

T1543 Create or Modify System Process

Initial Access

T1566 Phishing

Resource Development

T1583 Acquire Infrastructure; T1584 Compromise Infrastructure

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in ClickLock: New macOS Infostealer Uses ClickFix Lure and

  • Apple — macOS
    Vulnerable versions: macOS (all versions susceptible to social engineering, incl. post-26.4)

Remediation for ClickLock: New macOS Infostealer Uses ClickFix Lure and

Immediate actions

  • Revoke and re-authenticate all active browser sessions on any suspected-compromised Mac
  • Reset all passwords saved in browsers, password managers, and the macOS Keychain
  • Rotate/regenerate cryptocurrency wallet seed phrases and private keys for any wallet present on the device
  • Boot into macOS Recovery/Safe Mode (Apple silicon: hold power button until 'Loading startup options', select the boot volume, hold Shift, click Continue) to remove persistence outside normal runtime
  • Manually inspect and remove ~/Library/LaunchAgents/com.authirity.plist and ~/Library/LaunchAgents/com.chromer.plist
  • Remove ~/Library/Application Support/iCloudsync/iCloud and kill any SystemUIServerl process
  • Change FileZilla and any other stored service/server credentials found on the device
  • Review and revoke any Telegram bot tokens or sessions inadvertently exposed

Workarounds

  • Disable/restrict Script Editor and Terminal automatic invocation via URL schemes where feasible in managed fleets
  • Enforce Full Disk Access approval prompts and audit unexpected grants

Longer-term hardening

  • Deploy EDR/behavioral monitoring for LaunchAgent creation events and rapid repeated process-kill patterns targeting Finder/Dock/Terminal/browsers
  • Enable and enforce macOS 26.4+ Terminal paste-warning protections fleet-wide
  • Block outbound connections to known GSocket relay infrastructure (gsnc.eu and related GSRN endpoints) at the network egress layer
  • User-awareness training specifically on ClickFix / fake-CAPTCHA 'paste this command' lures
  • Monitor for applescript:// URL-scheme invocation and Script Editor auto-launch from browser contexts as an evasion of Terminal-only mitigations

Weaknesses (CWE) in ClickLock: New macOS Infostealer Uses ClickFix Lure and

CWE-451, CWE-506, CWE-522, CWE-798

Timeline of ClickLock: New macOS Infostealer Uses ClickFix Lure and

  • Apple ships macOS 26.4 with a Terminal paste-warning security feature designed to alert users before pasting/executing suspicious commands, directly targeting ClickFix-style delivery.
  • Jamf Threat Labs documents a ClickFix variant using the applescript:// URL scheme to auto-launch Script Editor, bypassing the new Terminal paste protections and delivering Atomic Stealer.
  • ClickLock campaign begins, roughly one month after macOS 26.4's Terminal paste-warning mitigation ships.
  • Microsoft documents a related ClickFix campaign using fake macOS utility lures, dscl-based local password validation, and staging in /tmp/shub_<ID>/ (SHub Stealer), alongside continued AMOS and MacSync activity.
  • Netskope Threat Labs intercepts an upgraded ClickFix campaign from a Russian-speaking attacker, expanded across 25 short-lived lure domains and bundling a full-featured persistent remote access trojan alongside the AppleScript-based stealer, targeting victims mainly in Asia, North America, and Oceania.
  • A ClickLock sample is uploaded to VirusTotal and records zero antivirus detections at time of upload.
  • Palo Alto Networks Unit 42 documents a related ClickFix campaign that silently mounts a malicious DMG to deliver a macOS infostealer, part of the same broader wave of ClickFix-driven macOS credential-theft activity.
  • The Hacker News publishes coverage of the Group-IB report, summarizing the ClickFix lure, app-killing LaunchAgent coercion, credential/Keychain/crypto-wallet theft, and the modified GSocket ('goyim') backdoor.
  • Group-IB publishes 'ClickLock Stealer: Paste Once, Lose Everything,' documenting 100+ victims across 33 countries since May 2026, with over 50% concentrated in Europe.

Sources cited for ClickLock: New macOS Infostealer Uses ClickFix Lure and

Threats related to ClickLock: New macOS Infostealer Uses ClickFix Lure and

Detection coverage for TL-2026-1421

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1421 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1421

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats