# ClickLock: New macOS Infostealer Uses ClickFix Lure and App-Killing LaunchAgents to Force Credential Entry

> ClickLock is a macOS infostealer distributed via a ClickFix-style Terminal-paste lure hidden behind a fake Cloudflare CAPTCHA. Victims who refuse a fraudulent Apple password prompt have Finder, Dock, Spotlight, Terminal, Activity Monitor, and browsers repeatedly killed by malicious LaunchAgents until they comply, after which the malware harvests the macOS login password, Keychain, browser Safe Storage keys, crypto wallets, password manager vaults, and shell history, and installs a modified GSocket ('goyim') reverse-shell backdoor for persistent access.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1421
- **ID:** TL-2026-1421
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ClickLock is delivered through a ClickFix-style social-engineering lure: a compromised or attacker-controlled webpage presents a fake, non-functional Cloudflare CAPTCHA with a cycling ten-second progress bar, then instructs the victim to paste and execute a Terminal command. The pasted command runs an orchestrator script (script.sh) that disables keyboard interrupts (SIGINT), hides the cursor, and retrieves four additional payloads from attacker-controlled hosts — two piped directly into bash and two written to a hidden staging directory at $HOME/.cacheb/.

Once staged, the malware displays a fake Apple system dialog (rendered via osascript, using icons staged in /tmp/) that is populated with the victim's real macOS username to increase credibility, prompting for the account password. Every submitted password is validated locally against `dscl /Local/Default -authonly` (or `dscl . -authonly <user>` in related campaigns) before being accepted, guaranteeing that only working credentials are exfiltrated and that failed attempts are rejected and re-prompted.

The defining coercion technique is app-killing persistence: two LaunchAgents are installed under ~/Library/LaunchAgents/ — com.authirity.plist runs 210-millisecond kill loops against Finder, Dock, Spotlight, Terminal, Activity Monitor, and installed browsers, and com.chromer.plist runs equivalent kill cycles at 0.2-second intervals for up to 3,000,000 seconds (~34.7 days), continuously terminating the victim's workflow until the password prompt is satisfied. A third loop kills NotificationCenter for six hours to suppress Gatekeeper and system security warnings during the compromise window. If Terminal lacks Full Disk Access, the malware walks the victim through an automated System Settings flow to grant it.

Upon successful credential validation, ClickLock harvests: the macOS login password; Chrome's Safe Storage AES decryption key (enabling offline decryption of exfiltrated Login Data/Cookies databases); browser saved credentials, cookies, and autofill data; cryptocurrency wallet browser-extension storage and desktop wallet application files; password manager vaults; Keychain contents (via `security find-generic-password` and related Keychain APIs); shell history; and FileZilla stored server credentials. Exfiltration is routed through Telegram bots (api.telegram.org traffic following bulk browser-profile reads).

For persistence, ClickLock installs 'goyim,' a modified reverse-shell component that replicates roughly 80% of the public gs-netcat deploy script from The Hacker's Choice's open-source GSocket toolkit. The backdoor requires no dedicated C2 infrastructure of its own — it authenticates with a shared secret to the Global Socket Relay Network (GSRN) via the operator relay gsnc.eu:67, giving the operator an encrypted, NAT/firewall-traversing reverse shell that the relay itself cannot decrypt. The binary is dropped as 'iCloud' inside ~/Library/Application Support/iCloudsync/ and executes under the process name SystemUIServerl — a single character removed from the legitimate macOS SystemUIServer process, a lightweight masquerade intended to blend into Activity Monitor.

Group-IB (report: 'ClickLock Stealer: Paste Once, Lose Everything,' published 2026-07-16) documented at least 100 victims across 33 countries since May 2026, with over 50% concentrated in Europe, and additional targeting reported across North America and the Middle East/Africa. A ClickLock sample uploaded to VirusTotal on 2026-06-09 recorded zero antivirus detections at the time. The campaign began in May 2026, roughly one month after Apple shipped Terminal paste-warning protections in macOS 26.4 (March 2026), placing it within a broader wave of ClickFix-style macOS campaigns (Microsoft's SHub Stealer reporting, May 2026; Jamf's April 2026 applescript:// Script Editor variant delivering Atomic Stealer; ongoing AMOS/Atomic macOS Stealer and MacSync activity) that are actively adapting ClickFix delivery to route around Apple's new Terminal-side mitigations.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1546 Event Triggered Execution
- T1543 Create or Modify System Process
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1564 Hide Artifacts
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1033 System Owner/User Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1074 Data Staged
- T1090 Proxy
- T1573 Encrypted Channel
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1499 Endpoint Denial of Service
- T1657 Financial Theft
- T1584 Compromise Infrastructure
- T1583 Acquire Infrastructure

## Sources

- [New ClickLock macOS Stealer Kills Apps Until You Enter Your Password](https://thehackernews.com/2026/07/new-clicklock-macos-stealer-kills-apps.html)
- [ClickLock Stealer: Paste Once, Lose Everything (Group-IB)](https://www.group-ib.com/blog/)
- [New macOS ClickFix attack silently mounts DMGs to push infostealer](https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [ClickFix Malware Uses macOS Script Editor to Deliver Atomic Stealer](https://www.jamf.com/blog/clickfix-macos-script-editor-atomic-stealer/)
- [macOS ClickFix attacks deliver AppleScript stealers (The Register)](https://www.theregister.com/2026/04/21/macos_clickfix_attacks_deliver_applescript/)
- [New macOS security feature will alert users about possible ClickFix attacks (Malwarebytes)](https://www.malwarebytes.com/blog/news/2026/03/new-macos-security-feature-will-alert-users-about-possible-clickfix-attacks)
- [ClickFix finds a new way to infect Macs (Malwarebytes)](https://www.malwarebytes.com/blog/news/2026/04/clickfix-finds-new-way-to-infect-macs)
- [Apple counters ClickFix attacks with macOS Terminal warning](https://www.helpnetsecurity.com/2026/03/31/apple-macos-clickfix-attacks-terminal-warning/)
- [ClickFix Campaigns Targeting Windows and macOS (Recorded Future)](https://www.recordedfuture.com/research/clickfix-campaigns-targeting-windows-and-macos)
- [Tech impersonators: ClickFix and macOS infostealers (Datadog Security Labs)](https://securitylabs.datadoghq.com/articles/tech-impersonators-clickfix-and-macos-infostealers/)
- [Evil evolution: ClickFix and macOS infostealers (Sophos)](https://www.sophos.com/en-us/blog/evil-evolution-clickfix-and-macos-infostealers)
- [Invisible Reverse Shells: How gsocket Backdoors Hide in Plain Sight](https://kbourdakos.gr/articles/invisible-reverse-shells-how-gsocket-backdoors-hide-in-plain-sight.html)
- [GSocket Bash Backdoor + FBI Botnet Bust: How Attackers Weaponize Legitimate Tools](https://hackernoob.tips/gsocket-bash-backdoor-fbi-botnet-takedown/)
- [macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT (Netskope)](https://www.netskope.com/blog/macos-clickfix-lures-deploy-applescript-stealer-persistent-rat)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1421