Security firm Group-IB has identified a new piece of macOS malware in the wild that pressures users into surrendering their passwords via a barrage of fake system prompts.
Dubbed "ClickLock Stealer," the malware needs no exploits and no elevated privileges to work. Instead, the attack depends on the victim pasting a command into Terminal and running it. The command then executes a script, and everything else follows.
Group-IB did not directly observe how victims are lured into pasting the command, but based on the script's behavior, the firm believes it's served through a fake "ClickFix" page posing as a Cloudflare check or browser verification step. Such pages instruct visitors to copy a command and run it in Terminal as a supposed "verification requirement."
Once it's up and running, the script discreetly downloads several modules and shows a terminal-based loading animation mimicking a Cloudflare progress bar with browser verification. If a user declines the initial password dialog that appears, the malware starts locking system usage.
Specifically, the malware kills every visible app every 210 milliseconds while the password prompt remains on screen, and the rest of the desktop stays unusable until the victim gives in. Meanwhile, another loop suppresses macOS security notifications for roughly six hours.
If the user gives up and enters their password, a second, genuine macOS prompt is subsequently forced to the front, asking them to allow access to a Keychain item. Granting it hands over Chrome's "Safe Storage" AES key, which is what the browser uses to encrypt saved passwords and cookies.
With the login password and Chrome's encryption obtained, ClickLock then harvests browser credentials, Keychain data, password manager vaults, and any cryptocurrency wallets, and then sends it all to a Telegram bot. It also installs a hidden backdoor disguised as an iCloud process to give it continual access.
Group-IB says the campaign has been active since May 2026 and has targeted at least 100 victims across 33 countries. More than half of the victims were in Europe.
Apple has already updated macOS to try to defend against this class of attack before it can get underway. In macOS Tahoe 26.4, it added a warning that appears when the user attempts to paste a command into Terminal from a website, chat, or message, and blocks the paste until the user reviews it. (Opera browser also recently added a similar feature.)
In cases where macOS detects known malware, the paste is blocked outright with no override. Still, it should go without saying that no legitimate website will ever ask a user to paste a command into Terminal.
