New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password
ClickLock macOS stealer forces password entry by killing apps every 210ms until victims comply.
ClickLock is a new macOS infostealer that arrives via terminal command and deploys LaunchAgents to forcibly extract login credentials. When users refuse an initial fake system dialog, the malware kills critical applications every 210 milliseconds until they provide their password. Once captured, it exfiltrates Keychain data, browser credentials, crypto wallets, and Chrome's Safe Storage encryption key, with at least 100 victims across 33 countries since May 2026.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Group-IB?
Get an email when a new story names Group-IB, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonClickLock exploits user psychology by creating an unbearable denial-of-service loop — killing critical applications every 210 milliseconds — until victims surrender their macOS login password to a fake system dialog. The root failure is a combination of insufficient user awareness about social engineering tactics and permissive macOS configuration that allows terminal-installed LaunchAgents to persist and execute with minimal friction. Once the password is obtained, the malware exfiltrates extraordinarily sensitive data including Keychain credentials, browser passwords, crypto wallets, and Chrome's Safe Storage key, effectively compromising the entire credential ecosystem. This attack illustrates how coercive UX manipulation can bypass even security-conscious users who would otherwise reject phishing attempts, making education about pressure-based social engineering critical.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ClickLock
- malware — ClickFix
- malware — com.authirity.plist
- malware — com.chromer.plist
- malware — script.sh