# ClickLock Stealer: macOS ClickFix Infostealer Uses 210ms Process-Kill Loops and Fake Authentication Dialogs to Coerce Credentials

> ClickLock Stealer is a macOS infostealer, first identified by Group-IB, delivered via a ClickFix social-engineering lure that tricks victims into pasting a Terminal command disguised as a Cloudflare human-verification step. Once executed, it kills desktop/security processes every 210ms and displays spoofed macOS authentication dialogs until the victim types their real login password, then harvests browser data, 31+ crypto wallet extensions, password managers, Keychain, shell history, and FTP credentials, exfiltrates via Telegram, and installs a persistent GSocket-based backdoor ('goyim').

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1440
- **ID:** TL-2026-1440
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** ClickLock Dev
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ClickLock Stealer is a modular macOS credential- and cryptocurrency-stealing malware family discovered and named by Group-IB Threat Intelligence in July 2026, with the campaign active since at least May 2026 — roughly one month after macOS 26.4 introduced Terminal paste warnings, suggesting rapid attacker adaptation to platform defenses. The malware is distributed through the ClickFix technique: victims land on phishing pages spoofing a Cloudflare 'Verify you are human' challenge and are instructed to open Terminal and paste a supplied command, framed as a required browser-verification step. No CVE or software vulnerability is exploited; the entire chain relies on social engineering and abuse of legitimate macOS utilities (osascript, dscl, launchctl, security, curl|bash).

The initial payload, an orchestrator shell script (script.sh, SHA1 d9617710d4ed8e9b87f6fee0b7014c4101effba0), disables keyboard interrupts (trap on SIGINT), hides the Terminal cursor, and renders a fake animated Cloudflare CAPTCHA banner ('Verifying you are not a bot', 'Collecting browser signals') for roughly 10 seconds while it silently fetches four additional modules from two to three compromised, cleanly-reputed domains (including a hacked WordPress site) disguised with misleading extensions (.txt, .jpg, .css) — a classic curl-piped-to-bash pattern. The orchestrator itself performs an initial osascript-based password prompt: the harvested password is validated locally via `dscl /Local/Default -authonly` before exfiltration, so only working credentials are ever sent to the attacker.

If the victim dismisses or cancels the first prompt, two persistence/coercion LaunchAgents are installed: com.authirity.plist runs a kill loop every 210 milliseconds against Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, NotificationCenter, SystemUIServer, all major browsers, and shell processes (fish, zsh) for up to ~83 hours (300,000 seconds) or until the password is captured, rendering the desktop unusable except for the fake password dialog. com.chromer.plist runs a second loop at ~200-250ms intervals for up to ~35 days (34.7 days) requesting a legitimate macOS Keychain-authorization prompt to obtain Chrome's Safe Storage AES key, used to decrypt saved browser credentials and cookies offline. A separate background loop kills NotificationCenter continuously for ~6 hours specifically to suppress Gatekeeper and other security warnings that might tip off the victim. If Terminal lacks Full Disk Access, the malware proactively opens System Settings to the correct privacy pane and walks the victim through granting it.

Following credential capture, dedicated modules (chromer — Chrome Safe Storage key extraction; zsh/zoom — fake-dialog password harvesting; finderv2/finder.sh — cryptocurrency and wallet harvesting) systematically loot: 8 browsers (Chrome, Brave, Edge, Opera, Vivaldi, Arc, Chromium, Firefox) for saved logins, cookies, autofill, and bookmarks; 31 Chromium-based crypto wallet extensions (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, Rainbow, Exodus, Keplr, Solflare, OKX Wallet, Backpack, Yoroi, Tonkeeper, Xverse, UniSat, Ronin, TronLink, Zerion, MyTonWallet, Bitget, Leather, Bittensor, and others) and 7 Firefox equivalents (MetaMask, Phantom, Ronin Wallet, Alby, FilSnap, Tonkeeper, Solflare); 7 password-manager extensions (Bitwarden, LastPass, 1Password, iCloud Passwords, NordPass, Keeper, Dashlane); 8 desktop wallet applications (Exodus, Coinomi, Electrum, Atomic Wallet, Wasabi Wallet, Bitcoin Core, Feather/Monero, 1Password); cached blockchain addresses across 6 chains (EVM, Bitcoin, Solana, TRON, TON, Stacks); macOS Keychain databases; shell history (~/.zsh_history, ~/.bash_history); and FileZilla FTP credentials (sitemanager.xml, recentservers.xml), including encrypted {data, iv, salt} vault blobs pulled from Chromium LevelDB and Firefox IndexedDB stores.

All stolen data is exfiltrated to attacker-controlled Telegram bots via the Telegram Bot API (large archives over 40MB are split into segments) — the campaign uses no dedicated C2 servers for exfiltration. A separate persistence component, the 'goyim' backdoor, is roughly 80% a reused copy of the open-source GSocket (gs-netcat) deploy script; it fingerprints the host, exfiltrates recon data, and notifies operators over Telegram, HTTP webhook, and DNS channels, connecting through the public GSocket relay gsnc[.]eu:67 rather than dedicated infrastructure. On disk it masquerades as iCloud sync software, installing to ~/Library/Application Support/iCloudsync and running as a process named 'SystemUIServerl' — one character off the legitimate SystemUIServer — and persists via LaunchAgent, crontab injection, and shell RC-file modification. Unlike every other module, goyim does not self-delete.

After completing their objectives, all other modules perform anti-forensic cleanup: they copy modification timestamps from the victim's ~/Movies directory onto their own files after every password attempt and state change (timestomping) to defeat forensic timeline reconstruction, remove their own LaunchAgent entries via launchctl, and self-delete (`rm -- "$0"`).

Group-IB discovered the orchestrator script on VirusTotal (submitted June 9, 2026) with zero antivirus detections at the time of analysis, and attributes the campaign to a threat actor tracked in its Threat Intelligence portal as 'ClickLock Dev.' As of the July 2026 report, telemetry shows at least 100 confirmed victims across 33 countries, with more than half concentrated in Europe, followed by North America and the Middle East/Africa region — consistent with financially-motivated targeting of regions with high macOS adoption and cryptocurrency usage. The malware is entirely social-engineering driven with no exploit or vulnerability component, underscoring the risk of the broader 'ClickFix' technique family now being adapted specifically to macOS.

## MITRE ATT&CK

- T1584 Compromise Infrastructure
- T1566 Phishing
- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1543.001 Launch Agent
- T1053.003 Cron
- T1546.004 Unix Shell Configuration Modification
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1685 Disable or Modify Tools
- T1686 Disable or Modify System Firewall
- T1564.001 Hidden Files and Directories
- T1140 Deobfuscate/Decode Files or Information
- T1056.002 GUI Input Capture
- T1539 Steal Web Session Cookie
- T1555.001 Keychain
- T1555.005 Password Managers
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1187 Forced Authentication
- T1033 System Owner/User Discovery
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1083 File and Directory Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1074.001 Local Data Staging
- T1071.001 Web Protocols
- T1090.002 External Proxy
- T1571 Non-Standard Port
- T1567.002 Exfiltration to Cloud Storage
- T1041 Exfiltration Over C2 Channel
- T1489 Service Stop
- T1499 Endpoint Denial of Service
- T1657 Financial Theft

## Sources

- [ClickLock macOS Stealer](https://cybersecuritynews.com/clicklock-macos-stealer/)
- [ClickLock Stealer: Paste Once, Lose Everything](https://www.group-ib.com/blog/clicklock-stealer-macos-malware/)
- [New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password](https://thehackernews.com/2026/07/new-clicklock-macos-stealer-kills-apps.html)
- ['ClickLock Stealer' Bypasses macOS Security With Social Engineering, Process Killing](https://www.securityweek.com/clicklock-stealer-bypasses-macos-security-with-social-engineering-process-killing/)
- [C'mon, just copy this text string and paste it into your macOS Terminal – it'll fix your computer, honest](https://www.theregister.com/cyber-crime/2026/07/16/cmon-just-copy-this-text-string-and-paste-it-into-your-macos-terminal-itll-fix-your-computer-honest/5273701)
- [Modular macOS Stealer Uses Kill Loops to Force Password Entry](https://www.infosecurity-magazine.com/news/clicklock-macos-stealer-clickfix/)
- [New ClickLock macOS malware traps users into revealing login password](https://www.bleepingcomputer.com/news/security/new-clicklock-macos-malware-traps-users-into-revealing-login-password/)
- ['ClickLock Stealer' Bypasses macOS Security With Social Engineering, Process Killing (OODA)](https://oodaloop.com/briefs/cyber/clicklock-stealer-bypasses-macos-security-with-social-engineering-process-killing/)
- [Nouveau voleur de données macOS découvert par Group-IB](https://www.undernews.fr/malwares-virus-antivirus/nouveau-voleur-de-donnees-macos-decouvert-par-group-ib-aucune-detection-sur-virustotal-aucune-exploitation-requise.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1440