Understanding the ClickLock Malware Threat to Your Mac

Cyber threats often evolve, and a new malware attack is taking advantage of Mac users by using a method that begins with a fake verification page. This page instructs users to open Terminal, a Mac application for running commands, and paste a specific command. The result is the clandestine installation of malicious software known as ClickLock.

How ClickLock Infiltrates Your Mac

Once an unsuspecting user pastes the command into Terminal, a progress bar appears, but behind the scenes, the malware downloads and installs itself. Following this, a seemingly legitimate macOS password box might appear. If you cancel this prompt, the malware could re-emerge after you log in again, repeatedly causing disruptions by closing Finder, browsers, and other apps. This turns your Mac into a nearly unusable device until the login password is entered.

The Threat of ClickLock

ClickLock is designed to extract personal information. It seeks out saved passwords, browser data, and cryptocurrency wallets. Additionally, it can enable a remote connection, allowing attackers access to your computer long after initial contact. Researchers from Group-IB detected this malware on VirusTotal, a service checking files for threats. As of June 9, 2026, none of the platform’s security tools identified the malware, despite its spread to at least 100 systems in 33 countries.

Methods of Malware Spread and Attack

The attack does not exploit any specific macOS vulnerabilities or require admin access. Instead, it relies on convincing users to run the malicious command themselves. Group-IB suggests that the malware spreads via tactics mimicking genuine error or verification pages, known as ClickFix. These fake pages display a simulated Cloudflare verification process, but during this time, the malware disables user interruptions and stealthily downloads its components.

Stealthy Password Extraction

Once installed, the malware generates a false macOS password prompt, which mimics legitimate system requests. Entering your password results in it being transmitted to the attacker through Telegram. Incorrect passwords prompt repeated requests. Canceling the prompt activates mechanisms that ensure the malware reinstalls during subsequent logins.

Impact on Browser and Keychain Security

Another malicious component specifically targets the Safe Storage key used by Chrome and other Chromium-based browsers to encrypt stored information. The tactic involves a real macOS Keychain prompt, waiting for user approval. During this time, the malware continues its operations, running loops designed to make it difficult to use the Mac normally.

What ClickLock Can Access

The malware looks into eight browsers, including Chrome, Firefox, and Edge, for data such as saved passwords, session cookies, autofill info, bookmarks, and more. It looks for desktop cryptocurrency wallets and encrypted vaults. Additionally, it collects Terminal command histories and other sensitive data. The information is compiled into a ZIP file and sent to the attacker, often using Telegram’s Bot API.

Defensive Measures Against ClickLock

To protect against ClickLock, avoid executing unfamiliar commands in Terminal. Be suspicious of any prompts requiring administrative login details when not expected. Keep your macOS updated for the latest security measures and install strong antivirus software. If your Mac begins malfunctioning, restart it in Safe Mode without entering passwords, and seek professional assistance. Finally, secure your online accounts by changing passwords via a trustworthy device.

Kurt’s Tech Tips

Remember, no legitimate website requires Terminal verification. Stay vigilant against suspicious activity by recognizing unusual password requests and ongoing interruptions like app closures. Regularly update your security practices to safeguard your data.