As noted by MacRumors, the security firm Group-IB has identified a new piece of macOS malware in the wild that pressures users into surrendering their passwords via a barrage of fake system prompts.
“ClickLock Stealer” needs no exploits and no elevated privileges to work. Instead, the attack depends on the victim pasting a command into Terminal and running it. The command then executes a script, and everything else follows. Here are details from the Group-1B report:
- Group-IB has discovered and analyzed new malware targeting macOS users that we have named ClickLock Stealer.
- ClickLock Stealer targets data from 8 browsers, 31 crypto wallet browser extensions, 7 password manager extensions, 8 desktop wallet applications, extracts blockchain addresses across 6 chains, macOS Keychain, shell history and FTP credentials.
- We assess with high confidence that the malware likely is or will be distributed via phishing pages employing ClickFix technique.
- Adversaries use a slightly modified version of an open-source tool GSocket as one of the components.
- Based on the code structure and other observed artifacts, we assume that the malware is still under development.
- A ClickLock Stealer operation has already targeted at least 100 victims in 33 countries, with more than 50% from Europe, and has been active for approximately two months, since May 2026.
I hope you’ll help support Apple World Today by becoming a patron. Almost all our income is from Patreon support and sponsored posts. Patreon pricing ranges from $2 to $10 a month. Thanks in advance for your support.
