ClickLock macOS Stealer: New Malware Uses Extortion and Kill Loops

A highly sophisticated and aggressive malware campaign has sent shockwaves through the Apple desktop ecosystem, exposing critical vulnerabilities in the way users interact with native administrative tools. Dubbed the ClickLock macOS Stealer, this newly discovered threat represents a significant evolution in macOS-focused cybercrime. While historical macOS threats typically relied on silent execution or complex zero-day exploits, this malware relies on a highly coercive combination of social engineering, digital extortion, and brute system disruption. First identified by threat intelligence researchers at Group-IB, the campaign has already claimed victims across 33 countries, targeting high-income regions including Italy, the United States, the United Kingdom, and Jordan. By focusing on areas with high macOS market share and cryptocurrency adoption, the actors behind this malware have designed an extremely targeted, financially motivated weapon.

The Gateway: “ClickFix” Social Engineering and Pastejacking

The initial entry point for the ClickLock macOS Stealer does not rely on software vulnerabilities or architectural flaws within the macOS kernel. Instead, it exploits human trust and urgency through a delivery mechanism known as “ClickFix” (or pastejacking). Victims are routed to compromised websites or hijacked domains—often built on WordPress—that display fake system warning messages. These warning screens frequently masquerade as automated Cloudflare browser verification checks or Google Chrome error pages.

When a user visits one of these compromised pages, they are presented with an alert stating that their browser failed to load a required component. The page instructs the user to copy a pre-formatted command snippet to their clipboard and paste it directly into their macOS Terminal to “resolve” the issue. This user-initiated execution model is a masterclass in security bypass. Because the victim manually copies, opens, and executes the script within the Terminal, macOS Gatekeeper and notarization protocols are entirely circumvented. Gatekeeper is designed to verify the signatures of downloaded applications, but it cannot police commands manually executed by an authenticated user in a native shell. Once the return key is pressed, the orchestrator bash script begins its destructive workflow.

Dissecting the Modular Payload Architecture of the ClickLock macOS Stealer

As soon as the initial script runs in the Terminal, it initiates a series of environmental manipulations. It instantly hides the user’s mouse cursor and renders a full-screen, fake Cloudflare loading animation. This visual smoke screen is designed to pacify the user, making them believe a legitimate security verification process is occurring in the background. Behind this animation, the orchestrator script quietly communicates with compromised WordPress sites to download four highly specialized, modular payloads:

• The Chrome and Keychain Extraction Module: This module is engineered to target local credentials. It specifically queries the macOS system for the Chrome Safe Storage key. This key is an AES key stored within the user’s macOS Keychain that Google Chrome uses to encrypt offline databases containing saved passwords and session cookies. By acquiring this key, the malware enables offline decryption of the user’s entire web browsing history, active session tokens, and saved credentials.
• The AppleScript Authentication Spoof: To gain administrative access, the malware deploys a module that generates fake macOS system dialogue boxes using AppleScript. These dialogues are styled to look identical to legitimate macOS password prompts. Crucially, the module does not simply capture and exfiltrate any string typed by the user. Instead, it uses the native dscl (Directory Service Command Line) utility—specifically dscl . -authonly—to validate the input against the local directory service in real time. If the user enters an incorrect password, the dialogue displays a native error and prompts them again, ensuring the threat actors only receive valid credentials.
• The Cryptocurrency Wallet Harvester: ClickLock scans the system for local cryptocurrency data, systematically checking database files in the LevelDB directories of various browsers. It targets 31 different crypto wallet extensions, including MetaMask, Phantom, and Coinbase Wallet, as well as 8 standalone desktop wallet applications. This module extracts private keys, seed phrases, and vault files across 6 major blockchain networks.
• The GSocket Reverse-Shell Backdoor: To maintain long-term access, the malware deploys a customized backdoor based on GSocket, an open-source port-forwarding and reverse-shell tool. Reusing roughly 80% of GSocket’s original code base, the backdoor operates under the binary name goyim and is registered as a background service designed to look like a legitimate Apple iCloud daemon. This provides the attackers with persistent command-line access to the system, bypassing firewalls and NAT configurations.

Coercive Extortion: The 83-Hour System “Kill Loop”

The defining characteristic of the ClickLock macOS Stealer is its aggressive fallback mechanism. In a standard information-stealing attack, if a user rejects a password prompt or closes the terminal, the malware typically fails or retreats to avoid detection. ClickLock, however, adopts an extortion-style escalation routine.

If the victim cancels, closes, or ignores the AppleScript password prompt, the orchestrator immediately deploys two persistent LaunchAgents within the user’s ~/Library/LaunchAgents directory. These configurations ensure that even if the computer is turned off or restarted, the malware will execute automatically upon the next user login. Once persistence is established, the malware initiates a brutal “kill loop”.

Operating on a relentless cycle of every 210 milliseconds (approximately 300 times a minute), the malware forces the immediate termination of critical macOS system applications and user utilities. The list of targeted processes includes:

• Finder (preventing any file navigation or desktop interaction)
• Dock (removing access to application shortcuts and window management)
• Terminal (blocking the user from executing manual remediation commands)
• Activity Monitor (preventing the user from identifying or killing the malicious process)
• System Settings (blocking access to security configurations or profile management)
• Web Browsers (such as Safari, Chrome, and Firefox, preventing users from searching for help)

To further isolate the victim, the malware suppresses the macOS NotificationCenter for up to six hours, ensuring that any system diagnostics, antivirus alerts, or security notifications are silenced. This aggressive process-killing loop is programmed to run for up to 300,000 seconds, which translates to roughly 83 hours (nearly three and a half days). By systematically rendering the operating system completely unusable, the malware forces the victim into a state of operational exhaustion, leaving them with only one functional interface on their screen: the counterfeit password dialogue box. The user is given a grim choice—either leave their Mac entirely unusable for over three days, or input their password to restore system functionality.

Stealth Tactics, Timestomping, and Self-Deletion

In addition to its overt coercion techniques, the ClickLock macOS Stealer features stealth capabilities designed to frustrate post-incident forensic investigations. Once the user complies and enters their valid password, the AppleScript module transmits the verified credential, along with a detailed hardware and network fingerprint of the host system, to the attackers via a Telegram bot API.

With its primary data-harvesting objectives complete, the malware initiates a cleanup phase. The local stealer modules employ timestomping techniques, altering the file creation and access timestamps of their operational directories to match legitimate system binaries created months or years prior. This actively disrupts timeline-based forensic analysis. Following this, the modular stealer files, the initial orchestrator script, and the newly created LaunchAgents are systematically deleted from the disk. However, this cleanup is deceptive; while the disruptive, noisy components are purged to hide the compromise, the GSocket reverse-shell backdoor remains active and hidden in the background, ensuring the threat actors retain administrative access to the system indefinitely.

Defensive Strategies and Mitigation Protocols

The emergence of the ClickLock campaign highlights a critical shift in how security teams must approach macOS endpoint defense. Because the attack chain relies entirely on user-executed shell scripts rather than traditional binary execution, standard file-scanning security software may fail to detect the initial intrusion. Security administrators and end-users should adopt the following defensive guidelines to protect their environments:

1. Enforce strict policies against terminal pasting: Users must be educated on the extreme risks of copying and pasting untrusted commands into the Terminal. Modern web browsers and macOS commands now sometimes prompt warnings when unsafe pasting is detected; these warnings must never be bypassed.
2. Implement MDM Restrictions: Enterprise security teams should utilize Mobile Device Management (MDM) profiles to restrict access to the Terminal application for non-technical users, or enforce restricted shells that limit the execution of curl or bash commands from the clipboard.
3. Monitor LaunchAgent Creation: Implement behavioral monitoring tools to flag the unauthorized creation of files within ~/Library/LaunchAgents and ~/Library/LaunchDaemons. Any script registering itself as a persistent daemon should trigger immediate isolation of the host.
4. Utilize Advanced Endpoint Detection and Response (EDR): Traditional antivirus signatures struggle with dynamic bash execution. EDR agents should be configured to detect parent-child process anomalies, such as a web browser process spawning a shell script that subsequently calls utilities like dscl or attempts to access Chrome’s Safe Storage key database.

Ultimately, the ClickLock macOS Stealer serves as a stark reminder that as operating system security architectures harden, threat actors will pivot their focus toward the human interface. By weaponizing system management tools and exploiting the natural urge to “fix” technical errors, modern malware can bypass even the most robust built-in platform protections. Staying secure in this evolving landscape requires a combination of behavioral vigilance, rigorous endpoint telemetry, and an absolute refusal to run unverified, copied commands on local machines.