Security firm Group-IB has identified new macOS malware in the wild that pressures users to surrender their passwords through a barrage of fake system prompts.
Dubbed “ClickLock Stealer,” the malware does not require any exploits or elevated privileges to function. Instead, the attack depends on the victim pasting a command into the terminal and executing it. The command then runs a script and everything else follows.
Group-IB has not directly observed how victims are tricked into pasting the order, but based on the script’s behavior, the company believes it is served via a fake “ClickFix” page masquerading as a Cloudflare verification or browser verification step. Such pages ask visitors to copy a command and execute it in the terminal as a so-called “verification requirement”.
Once operational, the script quietly downloads multiple modules and displays a terminal-based loading animation mimicking a Cloudflare progress bar with browser verification. If a user refuses the initial password dialog box that appears, the malware begins locking out use of the system.
Specifically, the malware kills all visible applications every 210 milliseconds while the password prompt remains on screen, and the rest of the desktop remains unusable until the victim gives in. Meanwhile, another loop suppresses macOS security notifications for about six hours.
If the user gives up and enters their password, a second genuine macOS prompt is then brought to the forefront, asking them to allow access to a keychain item. Granting it hands over Chrome’s AES “Safe Storage” key, which the browser uses to encrypt saved passwords and cookies.
Once Chrome’s login password and encryption are obtained, ClickLock then collects browser credentials, keychain data, password manager vaults, and any cryptocurrency wallets and sends it all to a Telegram bot. It also installs a hidden backdoor disguised as an iCloud process to give it continuous access.
Group-IB says the campaign has been active since May 2026 and has targeted at least 100 victims in 33 countries. More than half of the victims were in Europe.
Apple has already updated macOS to try to defend against this class of attacks before it can occur. In macOS Tahoe 26.4, it added a warning that appears when the user tries to paste a command into the terminal from a website, chat, or message, and blocks pasting until the user reviews it. (The Opera browser also recently added a similar feature.)
In cases where macOS detects known malware, pasting is blocked outright without override. Still, it goes without saying that no legitimate website will ever ask a user to paste a command into Terminal.
