A newly discovered macOS malware named ClickLock Stealer has used social engineering and process‑killing tactics to steal passwords, cryptocurrency wallets and keychain data from at least 100 victims across 33 countries, with Europe accounting for the majority.

मुख्य बिंदु (Key Takeaways)

  • ClickLock Stealer bypasses macOS defenses through social engineering.
  • The malware harvests passwords, crypto wallets, keychain entries and sends them to a Telegram bot.
  • Victims are tricked into running a malicious bash command that pulls down multiple credential‑stealing scripts.

Cyber‑security firm Group‑IB first spotted the macOS‑specific malware “ClickLock Stealer” in early June, with evidence suggesting its activity dates back to late May. Since then, the threat has affected more than 100 users in 33 nations, over half of whom reside in Europe.

Attack Vector and Distribution

Researchers suspect that threat actors leveraged SEO poisoning, deceptive social‑media posts, or compromised websites to lure victims to a counterfeit “ClickFix” page masquerading as a Cloudflare verification. The page instructs users to copy a Bash command, paste it into macOS Terminal, and execute it. Once run, an orchestrator script downloads four additional payloads: a credential stealer, a cryptocurrency stealer, a Keychain stealer, and a backdoor installer.

Read Also:Jscrambler npm package compromised with info‑stealer malware affecting 1,500 downloads

Data Harvesting Mechanics

The harvested information – ranging from web‑browser data, crypto‑wallet extensions, password‑manager add‑ons, to blockchain addresses on six chains – is bundled into an archive and exfiltrated via a Telegram bot. To obtain the targeted data, the malware employs aggressive process‑killing loops. It displays a fake macOS dialog requesting the user’s password while terminating every visible process, ensuring the password prompt remains the sole window on screen.

Process‑Killing and Keychain Exploitation

Group‑IB observed a background loop that continuously kills macOS NotificationCenter for roughly six hours, suppressing any Gatekeeper or security warnings that might alert the victim. When the malware queries the macOS Keychain for the Chrome Safe Storage encryption key, the user is prompted to authorize the request. All other applications are terminated until the user complies, allowing the attacker to extract the keychain entry.

Implications and Mitigation

While macOS’s built‑in protections make it harder for traditional malware to gain a foothold, ClickLock Stealer’s success hinges on social engineering rather than exploit chains. The threat does not require privilege escalation; it runs with the victim’s own privileges. Security experts advise users to avoid copying unknown commands, verify the authenticity of verification pages, and employ multi‑factor authentication for keychain access to mitigate such attacks.