ClickLock Stealer is a modular macOS credential- and cryptocurrency-stealing malware family discovered and named by Group-IB Threat Intelligence in July 2026, with the campaign active since at least May 2026 — roughly one month after macOS 26.4 introduced Terminal paste warnings, suggesting rapid attacker adaptation to platform defenses. The malware is distributed through the ClickFix technique: victims land on phishing pages spoofing a Cloudflare 'Verify you are human' challenge and are instructed to open Terminal and paste a supplied command, framed as a required browser-verification step. No CVE or software vulnerability is exploited; the entire chain relies on social engineering and abuse of legitimate macOS utilities (osascript, dscl, launchctl, security, curl|bash).

The initial payload, an orchestrator shell script (script.sh, SHA1 d9617710d4ed8e9b87f6fee0b7014c4101effba0), disables keyboard interrupts (trap on SIGINT), hides the Terminal cursor, and renders a fake animated Cloudflare CAPTCHA banner ('Verifying you are not a bot', 'Collecting browser signals') for roughly 10 seconds while it silently fetches four additional modules from two to three compromised, cleanly-reputed domains (including a hacked WordPress site) disguised with misleading extensions (.txt, .jpg, .css) — a classic curl-piped-to-bash pattern. The orchestrator itself performs an initial osascript-based password prompt: the harvested password is validated locally via `dscl /Local/Default -authonly` before exfiltration, so only working credentials are ever sent to the attacker.

If the victim dismisses or cancels the first prompt, two persistence/coercion LaunchAgents are installed: com.authirity.plist runs a kill loop every 210 milliseconds against Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, NotificationCenter, SystemUIServer, all major browsers, and shell processes (fish, zsh) for up to ~83 hours (300,000 seconds) or until the password is captured, rendering the desktop unusable except for the fake password dialog. com.chromer.plist runs a second loop at ~200-250ms intervals for up to ~35 days (34.7 days) requesting a legitimate macOS Keychain-authorization prompt to obtain Chrome's Safe Storage AES key, used to decrypt saved browser credentials and cookies offline. A separate background loop kills NotificationCenter continuously for ~6 hours specifically to suppress Gatekeeper and other security warnings that might tip off the victim. If Terminal lacks Full Disk Access, the malware proactively opens System Settings to the correct privacy pane and walks the victim through granting it.

Following credential capture, dedicated modules (chromer — Chrome Safe Storage key extraction; zsh/zoom — fake-dialog password harvesting; finderv2/finder.sh — cryptocurrency and wallet harvesting) systematically loot: 8 browsers (Chrome, Brave, Edge, Opera, Vivaldi, Arc, Chromium, Firefox) for saved logins, cookies, autofill, and bookmarks; 31 Chromium-based crypto wallet extensions (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, Rainbow, Exodus, Keplr, Solflare, OKX Wallet, Backpack, Yoroi, Tonkeeper, Xverse, UniSat, Ronin, TronLink, Zerion, MyTonWallet, Bitget, Leather, Bittensor, and others) and 7 Firefox equivalents (MetaMask, Phantom, Ronin Wallet, Alby, FilSnap, Tonkeeper, Solflare); 7 password-manager extensions (Bitwarden, LastPass, 1Password, iCloud Passwords, NordPass, Keeper, Dashlane); 8 desktop wallet applications (Exodus, Coinomi, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Feather/Monero, 1Password); cached blockchain addresses across 6 chains (EVM, Bitcoin, Solana, TRON, TON, Stacks); macOS Keychain databases; shell history (~/.zsh_history, ~/.bash_history); and FileZilla FTP credentials (sitemanager.xml, recentservers.xml), including encrypted {data, iv, salt} vault blobs pulled from Chromium LevelDB and Firefox IndexedDB stores.

All stolen data is exfiltrated to attacker-controlled Telegram bots via the Telegram Bot API (large archives over 40MB are split into segments) — the campaign uses no dedicated C2 servers for exfiltration. A separate persistence component, the 'goyim' backdoor, is roughly 80% a reused copy of the open-source GSocket (gs-netcat) deploy script; it fingerprints the host, exfiltrates recon data, and notifies operators over Telegram, HTTP webhook, and DNS channels, connecting through the public GSocket relay gsnc[.]eu:67 rather than dedicated infrastructure. On disk it masquerades as iCloud sync software, installing to ~/Library/Application Support/iCloudsync and running as a process named 'SystemUIServerl' — one character off the legitimate SystemUIServer — and persists via LaunchAgent, crontab injection, and shell RC-file modification. Unlike every other module, goyim does not self-delete.

After completing their objectives, all other modules perform anti-forensic cleanup: they copy modification timestamps from the victim's ~/Movies directory onto their own files after every password attempt and state change (timestomping) to defeat forensic timeline reconstruction, remove their own LaunchAgent entries via launchctl, and self-delete (`rm -- "$0"`).

Group-IB discovered the orchestrator script on VirusTotal (submitted June 9, 2026) with zero antivirus detections at the time of analysis, and attributes the campaign to a threat actor tracked in its Threat Intelligence portal as 'ClickLock Dev.' As of the July 2026 report, telemetry shows at least 100 confirmed victims across 33 countries, with more than half concentrated in Europe, followed by North America and the Middle East/Africa region — consistent with financially-motivated targeting of regions with high macOS adoption and cryptocurrency usage. The malware is entirely social-engineering driven with no exploit or vulnerability component, underscoring the risk of the broader 'ClickFix' technique family now being adapted specifically to macOS.