'ClickLock' Malware Coerces Mac Users Into Giving Up Passwords

Security firm Group-IB has identified a new piece of macOS malware in the wild that pressures users into surrendering their passwords via a barrage of fake system prompts. Dubbed "ClickLock Stealer," the malware needs no exploits and no elevated privileges to work. Instead, the attack depends on the victim pasting a command into Terminal and running it. The command then executes a script, and everything else follows. Group-IB did not directly observe how victims are lured into pasting the command, but based on the script's behavior, the firm believes it's served through a fake "ClickFix" page posing as a Cloudflare check or browser verification step. Such pages instruct visitors to copy a command and run it in Terminal as a supposed "verification requirement." Once it's up and running, the script discreetly downloads several modules and shows a terminal-based loading animation mimicking a Cloudflare progress bar with browser verification. If a user declines the initial password dialog that appears, the malware starts locking system usage. Specifically, the malware kills every visible app every 210 milliseconds while the password prompt remains on screen, and the rest of the desktop stays unusable until the victim gives in. Meanwhile, another loop suppresses macOS security notifications for roughly six hours. If the user gives up and enters their password, a second, genuine macOS prompt is subsequently forced to the front, asking them to allow access to a Keychain item. Granting it hands over Chrome's "Safe Storage" AES key, which is what the browser uses to encrypt saved passwords and cookies. With the login password and Chrome's encryption obtained, ClickLock then harvests browser credentials, Keychain data, password manager vaults, and any cryptocurrency wallets, and then sends it all to a Telegram bot. It also installs a hidden backdoor disguised as an iCloud process to give it continual access. Group-IB says the campaign has been active since May 2026 and has targeted at least 100 victims across 33 countries. More than half of the victims were in Europe. Apple has already updated macOS to try to defend against this class of attack before it can get underway. In macOS Tahoe 26.4, it added a warning that appears when the user attempts to paste a command into Terminal from a website, chat, or message, and blocks the paste until the user reviews it. (Opera browser also recently added a similar feature.) In cases where macOS detects known malware, the paste is blocked outright with no override. Still, it should go without saying that no legitimate website will ever ask a user to paste a command into Terminal. Popular StoriesiPhone 18 Pro Launching in Two Months With These 12 New FeaturesIt is now mid-July, and that means the iPhone 18 Pro and iPhone 18 Pro Max are now just two months away. The devices are expected to look similar to the iPhone 17 Pro and iPhone 17 Pro Max, but there will still be many year-over-year changes, with rumored features including a smaller Dynamic Island, 5G via satellite, and more. Apple is expected to unveil the iPhone 18 Pro, iPhone 18 Pro Max, ...Apple Raises iCloud+ Prices in 8 CountriesFriday July 17, 2026 11:56 am PDT by Juli CloverApple has increased the price of iCloud+ in Nigeria, Türkiye, Vietnam, Japan, Egypt, New Zealand, the Philippines, and Indonesia, according to an updated version of its iCloud support document. Price increases range from 11 percent to 55 percent depending on the plan and the country. Nigeria saw the biggest hike, and a 50GB plan is now ₦1,300, up from ₦900. Türkiye saw the next largest...'AppleCare One' is Now Even More ValuableWhile the monthly and annual prices of AppleCare+ plans for Macs and iPads received a slight increase this week, AppleCare One continues to start at $19.99 per month in the U.S., making the multi-device plan even more valuable. Launched in July 2025, AppleCare One allows you to cover up to three devices as part of a single subscription for $19.99 per month, and additional devices can be...