A new macOS information stealer called ClickLock has been discovered that targets user passwords and cryptocurrency wallets while bypassing Apple’s built-in security protections. The malware uses social engineering combined with aggressive process manipulation to trick victims into revealing their credentials.
ClickLock arrives as a command that users are tricked into pasting into Terminal, often through social engineering or tech support scams. Once executed, it presents a fake system dialog asking for the login password. If the victim cancels, the malware installs background agents that repeatedly kill critical applications including Finder, the Dock, and Spotlight until the user complies.
After obtaining the password, ClickLock can access the system keychain, password managers, browser-stored credentials, and cryptocurrency wallet files. The malware has been observed targeting at least 100 users and is capable of exfiltrating data to remote servers.
What makes ClickLock particularly dangerous is that it uses a properly signed and notarized dropper to pass Apple’s Gatekeeper checks. This means macOS does not warn users about the software’s malicious nature during installation.
Security researchers at Jamf Threat Labs, who identified the malware, note that ClickLock is implemented in native C++, differing from other macOS stealers that are typically built on AppleScript droppers or Objective-C wrappers. This makes analysis more difficult for security tools.
To protect against ClickLock, users should never paste commands into Terminal from untrusted sources, particularly from websites, emails, or social media messages claiming to fix computer problems. Maintaining regular backups and using comprehensive security software is also recommended.
This article was adapted from The Hacker News. Read the original here.
