[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foH6LQKkW6k_vk_PZCOV1fNVSoMDyXv9dMFGH49LdXAc":3},{"article":4,"iocs":42,"watch_terms":49,"solutions":50,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"3a6e9a93-a096-4728-8b80-3fa7af327935","‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing","clicklock-stealer-bypasses-macos-security-with-social-engineering-process-killin-1d5206","The new macOS malware has targeted at least 100 users to steal their passwords and cryptocurrency. The post ‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing appeared first on SecurityWeek.","ClickLock Stealer is a new macOS malware discovered by Group-IB in early June that has targeted at least 100 users across 33 countries. The malware uses aggressive social engineering and process-killing techniques to bypass macOS protections, stealing credentials, cryptocurrency wallets, and Keychain data. Distribution likely occurs through SEO poisoning or compromised websites directing victims to fake ClickFix pages where they execute malicious bash commands.","ClickLock Stealer malware targets 100+ macOS users via social engineering to steal passwords and cryptocurrency.","https:\u002F\u002Fwww.securityweek.com\u002Fclicklock-stealer-bypasses-macos-security-with-social-engineering-process-killing\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F02\u002FMacOS-Mac-malware-Apple.jpeg","2026-07-16T12:43:59+00:00","2026-07-16T14:00:10.868182+00:00",8,[17,20,23,26],{"name":18,"type":19},"ClickLock Stealer operators","threat_actor",{"name":21,"type":22},"Group-IB","vendor",{"name":24,"type":25},"macOS","product",{"name":27,"type":28},"Telegram bot","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":29,"icon":31,"name":32,"slug":33},null,"Malware","malware",[35,37],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[43,46],{"type":33,"value":44,"context":45},"ClickLock Stealer","macOS stealer malware targeting passwords, crypto wallets, and Keychain data",{"type":33,"value":47,"context":48},"ClickFix","Social engineering attack page disguised as Cloudflare verification used to distribute ClickLock",[21,24],{"controls":51,"vendors":133},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":82,"name":83,"problem":84,"products":85},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",{"slug":111,"name":112,"problem":113,"products":114},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[115,122,127],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":119,"url":120,"description":121},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":123,"product_name":124,"url":125,"description":126},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":128,"product_name":129,"url":131,"description":132},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[134],{"slug":135,"name":136,"logo_path":137,"roles":138},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[139],"affected",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":156},"clicklock-stealer-exploits-macos-users-via-social-engineering-and-fake-fix-pages","ClickLock Stealer Exploits macOS Users via Social Engineering and Fake Fix Pages","ClickLock Stealer demonstrates how sophisticated social engineering — in this case fake 'ClickFix' pages delivered through SEO poisoning — can trick users into willingly executing malicious bash commands, effectively bypassing macOS built-in protections. Once executed, the malware kills security processes and exfiltrates sensitive data including credentials, cryptocurrency wallets, and macOS Keychain contents. This attack succeeds not because of an unpatched vulnerability, but because users are manipulated into becoming the attack vector themselves. The broad reach across 33 countries underscores that no platform, including macOS, is inherently safe when human behavior can be exploited. Organizations that assume macOS endpoints are low-risk are especially vulnerable to this class of threat.",[145,146,147,148,149,150,151,152,153,154,155],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AU-12 – Audit Record Generation","NIST SP 800-53 AC-6 – Least Privilege","MITRE ATT&CK T1204.002 – User Execution: Malicious File","MITRE ATT&CK T1056.001 – Input Capture: Keylogging","MITRE ATT&CK T1562.001 – Impair Defenses: Disable or Modify Tools","GDPR Article 32 – Security of Processing (for organizations handling EU user data)",{}]