How ClickLock Stealer Forces macOS Users to Give Up Passwords

Researchers at Group-IB have discovered a new macOS infostealer, ClickLock Stealer, which uses a fundamentally different approach to obtaining the system password: if the victim refuses to enter their credentials, the malware starts cyclically terminating key applications — Finder, Dock, Spotlight, Terminal, Activity Monitor, and browsers — every 210 milliseconds, turning the desktop into an unusable environment with a single password input window. According to Group-IB, since May the campaign has affected at least 100 targets in 33 countries, more than half of them in Europe. At the time of analysis, the orchestrator script had zero detections on VirusTotal.

Infection mechanics: from pasting into Terminal to taking over the desktop

Delivery of ClickLock is built on the ClickFix (T1204.004) technique — the victim is persuaded to paste a command into Terminal. The script accepts an RAY_ID parameter and displays a fake Cloudflare CAPTCHA banner with a progress bar consisting of twelve status lines — a purely decorative element to create an illusion of legitimacy. Behind this façade, the script disables keyboard interrupts, hides the cursor, and downloads four payloads from two compromised sites: two are piped directly into bash, and two are saved to a hidden directory $HOME/.cacheb/.

The first password request is an osascript dialog with a loaded Apple icon and the genuine username. The entered password is verified with the command dscl /Local/Default -authonly, and only a valid password is sent to the operator. According to Microsoft, this same validation technique was used in SHub Stealer, AMOS, and MacSync as part of the wave of macOS ClickFix campaigns in May.

If the victim clicks “Cancel,” the script installs two LaunchAgents — com.authirity.plist and com.chromer.plist in ~/Library/LaunchAgents/ — and quietly exits. Coercion begins at the next logon.

Dual coercion loop

The first LaunchAgent starts a process-killing loop at 210 ms intervals until a password is obtained. The second runs in parallel: it terminates processes every 0.2 seconds for up to 3,000,000 seconds (about 34.7 days) while simultaneously requesting the Chrome Safe Storage key from Keychain every half second. This request triggers a genuine macOS system dialog, and the process-killing loop keeps the desktop unusable until the victim approves access.

Activity Monitor and Terminal are included in both termination lists — the victim cannot diagnose the problem or stop the process using standard tools. A third loop terminates NotificationCenter for six hours, blocking the display of Gatekeeper alerts. If Terminal does not have Full Disk Access, the orchestrator opens System Settings to the required pane and walks the victim through granting the permission.

Group-IB describes sub-second pkill and killall invocations against Finder, Dock, SystemUIServer, and NotificationCenter as “behavior unique to coercive-interaction malware, with no legitimate use case.”

Scale of data theft and backdoor

Successful execution gives the operator: a validated macOS system password, the AES key for Chrome Safe Storage (enabling offline decryption of Login Data and Cookies files), and a ZIP archive containing browser credentials, cookies, crypto wallet extension stores, desktop wallet files, password manager vaults, Keychain contents, shell history, and saved FileZilla credentials. Exfiltration is carried out via three Telegram bots.

The backdoor component goyim is, according to Group-IB’s assessment, 80% copied from the public deployment script for GSocket — a tunneling tool providing encrypted reverse connectivity through a relay. The binary is downloaded from gsocket.io and connects to the operator’s relay at gsnc[.]eu:67. On macOS it is saved as iCloud in ~/Library/Application Support/iCloudsync and masquerades as the process SystemUIServerl — with an extra “l” at the end.

A critical detail: the stealer modules remove their own LaunchAgents, forge file timestamps throughout the ~/Movies directory to complicate forensics, and self-destruct. The goyim backdoor, however, remains. After the password is entered, the desktop appears normal, but a reverse shell is running on the machine.

Apple’s protections and their limitations

In macOS 26.4, released at the end of March, Apple added a warning for suspicious pastes into Terminal and blocking of known malware. However, as follows from Apple’s documentation, the warning is triggered only for users who do not use Terminal regularly and includes a “Paste Anyway” button. Blocking requires macOS to already know the malware’s signature.

Two bypass approaches emerged within weeks. Jamf Threat Labs recorded a campaign in April that used the applescript:// URL scheme to open Script Editor with a preloaded payload — the Terminal check does not trigger at all. ClickLock took a different path: it retained the Terminal paste but designed a coercion mechanism that makes the user’s refusal meaningless.

Indicators of compromise

• Orchestrator hash:3ce0504ba65f8d56f83d7fef45faeaeb31e4e5aa9b872b56610b5f2558231caa
• LaunchAgent files:com.authirity.plist, com.chromer.plist
• Backdoor:~/Library/Application Support/iCloudsync/iCloud, process SystemUIServerl
• Network indicators:gsnc[.]eu:67, traffic to api.telegram.org
• Behavioral signals: invocation of security find-generic-password from a shell script; osascript dialogs with icons loaded from /tmp/; bulk reading of browser profile directories; curl piped into bash from a URL ending in .jpg, .txt, or .css

Response recommendations

If your Mac starts repeatedly terminating applications and displays a single password input window — do not enter your password. No verification page ever requires access to Terminal; Cloudflare checks are performed in the browser.

1. Force shutdown: hold down the power button until the system turns off.
2. Boot into Safe Mode: on Intel — hold Shift while turning on; on Apple Silicon — hold the power button until “Loading startup options” appears, select the volume, then hold Shift and click “Continue in Safe Mode” (Apple’s guide).
3. Remove artifacts: check ~/Library/LaunchAgents/ for com.authirity.plist and com.chromer.plist; delete ~/Library/Application Support/iCloudsync and $HOME/.cacheb/.
4. If the password was entered: assume all saved passwords, cookies, wallet keys, and browser sessions are compromised. Revoke active sessions, change all passwords, and reissue cryptocurrency wallet keys.

ClickLock illustrates a shift in macOS infostealer tactics: instead of bypassing technical defenses, it applies coercive engineering in which the user’s refusal does not stop the attack but merely postpones it until the next logon. Organizations with Mac fleets should check for the listed IOCs, restrict Terminal privileges through MDM policies, and ensure users understand that legitimate system processes never repeatedly terminate Finder and Dock in order to obtain a password.