ClickLock Mac malware locks apps until you give in

A routine "verify you are human" page should never ask you to open Terminal, the Mac app used to run computer commands. Yet that is how a new malware attack appears to get onto a Mac. The page tells you to copy and paste a command into Terminal. It then shows a convincing progress bar while the command quietly downloads malicious software in the background.

Next, a password box may appear that looks like a normal macOS request. If you cancel it, the malware can come back after you sign in again and repeatedly close Finder, your browser and other apps. Your Mac may feel almost impossible to use until you enter your login password.

The malware, called ClickLock, is built to steal personal information from your Mac. It searches for saved passwords, browser data and cryptocurrency wallet files. It can also install a hidden tool that lets an attacker reconnect to your computer later and control it remotely.

Researchers at cybersecurity company Group-IB discovered the malicious script on VirusTotal, an online service that checks files for threats. Someone first uploaded it there on June 9, 2026, yet none of the security tools on the platform detected it at the time of the researchers' report. Group-IB says the campaign has targeted at least 100 systems across 33 countries since May.

Here is how ClickLock takes over a Mac and what you can do to protect yourself.

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our free CyberGuy Live class, "Sick of Spam?" , has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You’ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.

Get the free replay and checklist now at CyberGuyLive.com.

FAKE PASSWORD-MANAGER ALERTS COULD PUT YOUR VAULT AT RISK

ClickLock is a set of malicious scripts designed to steal sensitive information from a Mac. The malware can collect your Mac login password and browser data. It also searches for cryptocurrency wallet files, password manager extensions and information stored in macOS Keychain.

One component installs a persistent backdoor. That hidden connection can allow an attacker to access your Mac remotely even after the other parts of ClickLock remove themselves.

ClickLock gets started without exploiting a known macOS flaw. It also does not need admin-level access at the beginning. Instead, the attack depends on convincing you to run the command yourself.

Group-IB believes ClickLock likely spreads through a tactic called ClickFix. ClickFix attacks show you a fake error or verification request. The page then gives you a command that supposedly fixes the problem.

In this case, the ClickLock script displays a fake Cloudflare verification sequence after you paste the command into Terminal. An animated progress bar cycles through reassuring messages about checking browser signals and confirming you are human.

Meanwhile, the script disables keyboard interruptions and hides the Terminal cursor. It then downloads several malicious components in the background. Researchers have yet to confirm the exact landing pages used in the campaign. They also do not know whether people reached them through malicious search results, compromised websites, phishing messages or social media. However, the script's design strongly points to a ClickFix-style lure.

After the malware begins running, it displays a fake macOS password window. The pop-up uses your real username and an Apple icon downloaded by the attacker. If you enter a password, ClickLock checks it against your Mac. When the password works, the malware records it and sends it to the attacker through Telegram.

An incorrect password brings up another request. If you cancel the window, ClickLock installs two LaunchAgents. A LaunchAgent is a macOS instruction that can automatically run software when you sign in. In this case, the LaunchAgents bring the password-stealing components back at your next login.

HALLUSQUATTING AI ATTACK COULD HIJACK YOUR COMPUTER

When the password-stealing module returns, it begins closing visible apps every 210 milliseconds. It targets Finder, the Dock and Terminal. It also shuts down Activity Monitor, System Settings, Spotlight and common web browsers.

The fake password window may remain as the only useful item on your screen. That can make your Mac look broken while pressuring you to enter your password. Group-IB found that the loop can run for about 83 hours. It stops earlier when the malware captures a valid password.

A second ClickLock component targets Chrome's Safe Storage key. Chromium-based browsers use this key to help encrypt passwords, cookies and autofill information stored on your Mac. An attacker with the key and copied browser databases may be able to decrypt that information offline.

This part of the attack triggers a genuine macOS Keychain authorization prompt. However, the malware caused the request. ClickLock then runs another process-closing loop while waiting for you to approve access. Researchers found that this loop repeats every 200 milliseconds and can continue for nearly 35 days. The script also suppresses macOS NotificationCenter for roughly six hours. That could hide warnings or notifications that might reveal the attack.

ClickLock searches for information across eight browsers. Those browsers include Chrome, Firefox, Brave, Microsoft Edge, Opera, Vivaldi, Arc and Chromium.

The targeted browser information includes:

The malware also searches for desktop cryptocurrency wallets and encrypted wallet vaults. It can collect cached blockchain addresses across several networks. Other targets include macOS Keychain, Terminal command histories and FileZilla server details. The malware also records basic information about your Mac and its public IP address. ClickLock packages the collected information into a ZIP archive. It uploads that archive through Telegram's Bot API. Files larger than 40 MB get divided into smaller pieces, while retry code keeps trying after network failures.

One ClickLock component uses a modified version of the open-source GSocket tool. The malware installs a reverse shell, which gives the attacker a command-line connection to your Mac. On macOS, it disguises the backdoor as an iCloud-related process.

ClickLock uses a LaunchAgent and scheduled commands to keep the backdoor running. It also changes shell configuration files. Most of the other ClickLock modules delete themselves after completing their work. The GSocket component remains installed, which means the attacker may retain access after your Mac appears to return to normal.

The original ClickLock script had zero detections on VirusTotal when Group-IB analyzed it. Security vendors may update their detection tools as they learn more about the threat. The attackers also stored payloads on compromised websites that previously had clean reputations. Some components run without saving a normal file to the drive. Others erase themselves after stealing data.

However, ClickLock still produces suspicious activity while it runs. Warning signs include nonstop app closures, repeated password requests and sudden access to multiple browser folders. Security tools may also detect unusual connections to Telegram's API. For you, the earliest warning sign is much simpler. A website tells you to paste a command into Terminal. Legitimate human verification happens inside your browser. It should never require you to run a Terminal command.

These steps can help you avoid the ClickLock trap and respond quickly if the password loop starts.

Leave the page when it tells you to open Terminal and paste a command. A polished design offers no proof that the request is safe. Familiar logos can also be copied. Group-IB warns that a website asking you to use Terminal for verification is attempting to compromise your system.

Terminal commands can download software and change important settings. Never run an unfamiliar command simply to see what happens. Ask a trusted technical professional to inspect it first.

Think about what you were doing when the password window appeared. A website verification should have no reason to ask for your Mac login password. It should also have no reason to request access to Chrome information stored in Keychain. Cancel the request when the timing feels wrong.

Install macOS updates and keep automatic security updates turned on. Apple builds malware protection into macOS through Gatekeeper, Notarization and XProtect. Apple updates XProtect automatically as it identifies new malware. However, no built-in protection can eliminate every risk when you manually run a malicious command.

Strong antivirus software can provide another layer of protection against malicious files and suspicious behavior. Still, a clean scan cannot guarantee that ClickLock left nothing behind. The backdoor persists after other components erase themselves. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

Do not enter your password to make the pop-up disappear. Press and hold your Mac's power button for up to 10 seconds until the computer shuts down. On a MacBook with Touch ID, press and hold the Touch ID button. Group-IB recommends forcing a shutdown when your Mac becomes unresponsive and keeps requesting your password. The company then recommends starting the Mac in Safe Mode.

Mac with Apple silicon: Wait until the Mac shuts down completely. Press and hold the power button until "Loading startup options" appears. Select your startup volume. Hold the Shift key, then click Continue in Safe Mode.

Intel-based Mac: Turn on or restart the Mac. Immediately press and hold the Shift key until the login window appears.

Once Safe Mode starts, turn off Wi-Fi or unplug the Ethernet cable. Then contact Apple Support or a trusted cybersecurity professional. Removing a browser extension or clearing your history will not remove ClickLock's persistent backdoor.

Use a separate trusted device to change the password for your primary email account. Then secure your Apple Account and any financial accounts stored on the Mac. Change password manager credentials and review active sessions. Sign out of devices or sessions you do not recognize. Review the devices connected to your Apple Account and remove unfamiliar ones. Apple also recommends changing your Apple Account password when you suspect unauthorized access. After a professional cleans or resets the Mac, change its local login password. Assume the attacker received that password if you entered it into the ClickLock window.

ClickLock depends on one dangerous moment: convincing you to paste a command into Terminal. Once that happens, the malware can begin stealing information before the password pressure even starts. The biggest red flag is easy to remember. No trustworthy website needs Terminal to prove you are human. If your Mac starts closing apps and demanding a password, shut it down rather than giving in. Start in Safe Mode and get help checking for the persistent backdoor. Then use another trusted device to secure your most important accounts.

Have you ever seen a suspicious password prompt or fake verification page on your Mac? Tell us what it looked like and what you did next in the comments below. Let us know by writing to us at Cyberguy.com

Sign up for my FREE CyberGuy Report

Copyright 2026 CyberGuy.com. All rights reserved.