A recently identified variant of macOS malware employs advanced social engineering tactics. Rather than relying on code exploits or background data theft, it blocks normal Mac operation until the user supplies the login password.

Named ClickLock, this threat repeatedly terminates essential macOS services, suppresses alerts, shows realistic Apple authentication dialogs, and keeps victims in a cycle that stops only after the correct password is supplied. Once obtained, the malware targets browser information, digital currency holdings, stored logins, password vaults, and additional assets.

ClickLock targets users rather than exploiting Mac vulnerabilities.

Instead of depending on zero-day flaws or elevated privileges, ClickLock applies mental pressure to succeed. Infection likely starts via a ClickFix tactic that convinces users to paste a command into Terminal for a supposed Cloudflare check. While a false progress indicator distracts the victim, the malware fetches its components silently.

Simultaneously it blocks keyboard shortcuts, conceals the Terminal pointer, and silences Notification Center messages for about six hours, complicating detection of unusual activity.

The malware then presents an authentic-looking macOS password window that includes the real username and Apple styling. Correct entry allows immediate validation and transmission of credentials to attackers via Telegram.

Refusal triggers persistence routines that reactivate after reboot. ClickLock then terminates vital processes every 210 milliseconds, affecting Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, and common browsers.

Victims face a nearly inoperable Mac showing only the password dialog. Group-IB notes this cycle may persist beyond 83 hours or until the user yields.

The threat seeks extensive data beyond the initial password.

After obtaining the password, ClickLock prompts for genuine Keychain approval to access Chrome Safe Storage keys, enabling decryption of saved passwords, cookies, and autofill data from Chromium browsers.

Its theft module covers many targets. It extracts profiles from Chrome, Firefox, Brave, Microsoft Edge, Opera, Vivaldi, Arc, and Chromium, collecting passwords, cookies, bookmarks, sessions, local storage, and autofill entries.

Cryptocurrency holders encounter heightened danger. ClickLock hunts browser extensions, desktop files, encrypted vaults, and cached addresses across Bitcoin, Ethereum networks, Solana, TRON, TON, and Stacks.

It also gathers FileZilla settings, shell logs, system details, and public IP addresses, then packages the material into ZIP files for upload via Telegram Bot API. For ongoing control, it installs a modified GSocket backdoor that survives after other components self-delete. The malware resides on legitimate compromised sites and removes traces post-execution, yet indicators include repeated osascript password dialogs, frequent process terminations, broad browser folder access, and Telegram connections.

The core advice remains straightforward. Never paste Terminal commands from websites claiming to verify humanity. Force a power-button shutdown, boot into Safe Mode, and examine the system without entering credentials if repeated password requests appear. In this scenario, providing the password fulfills the attackers goals rather than resolving the issue.