ClickLock macOS malware kills apps in a loop until victims type their password

Group-IB detailed ClickLock, a macOS infostealer that coerces victims into handing over their login password. It arrives when a user is tricked into pasting a command into Terminal from a fake verification page, then shows a fake system dialog asking for the password. If the victim refuses, ClickLock begins killing core apps like Finder, the Dock, and browsers every 210 milliseconds, leaving only a password box on an unusable desktop, while also suppressing security notifications. Once the password is entered, it steals the Keychain, browser credentials, and cryptocurrency wallets and sends them to a Telegram bot. Group-IB counted at least 100 targets across 33 countries, over half in Europe.

Check

Warn Mac users never to paste Terminal commands from a website, and never enter a password to stop apps crashing; a Mac killing its own apps behind a password box is malware.

Affected

Mac users tricked into pasting a command from a fake verification page; ClickLock pressures them into entering their password by killing apps in a loop, then steals Keychain data and crypto wallets.

Fix

Only run Terminal commands you fully understand from trusted sources, treat app-killing loops and unexpected password prompts as attacks, and if infected, change passwords and wallet keys from a clean device.