A newly identified macOS malware, known as ClickLock, is targeting users by rendering their systems inoperable until they provide their login credentials. This sophisticated attack employs persistent social engineering tactics rather than exploiting software vulnerabilities.
Upon infection, ClickLock disrupts essential macOS applications such as Finder and Terminal every 210 milliseconds, effectively paralyzing the system. Concurrently, it displays relentless password prompts, coercing users into entering their credentials. This cycle can persist for over three days, leaving victims with little choice but to comply.
Once the user submits their password, ClickLock initiates the extraction of sensitive data. The malware collects information from various sources, including browser logins, cookies, password managers, cryptocurrency wallets, shell history, and FTP configurations. The harvested data is then compressed into a .ZIP file and transmitted using the Telegram Bot API.
Security researchers have traced ClickLock’s activity back to at least May 2026, with its presence confirmed in 33 countries, predominantly in Europe. The malware is believed to spread through a social engineering campaign dubbed ClickFix, which deceives users into executing malicious commands under the guise of legitimate processes. Notably, no specific threat actor has been linked to this operation.
ClickLock’s emergence underscores a growing trend in macOS-targeted malware that relies on manipulating user behavior rather than exploiting technical vulnerabilities. This approach highlights the importance of user vigilance and the need for robust security practices.
To mitigate the risk of such infections, users are advised to exercise caution when prompted to enter credentials, especially in unexpected contexts. It’s crucial to verify the legitimacy of such requests and avoid executing commands from untrusted sources. Additionally, keeping software up to date and employing reputable security solutions can provide an added layer of protection against evolving threats like ClickLock.
