[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMy65AIyNisQKP23YDi6DV3uxX4IB6kF5nFcNSkkGSbc":3},{"article":4,"iocs":36,"watch_terms":52,"solutions":53,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"dd843b30-598c-4ecd-ae4f-8bccce959c34","New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password","new-clicklock-macos-stealer-kills-apps-every-210ms-until-victims-type-their-pass-235a6e","ClickLock Stealer, a new macOS infostealer, answers a victim's refusal by killing their apps on a loop until they hand over the login password. It arrives as a command pasted into Terminal, asks for the password behind a fake system dialog, and when the victim cancels, installs two LaunchAgents and quietly exits. At the next login, Finder, the Dock, Spotlight, Terminal, Activity Monitor, and","ClickLock is a new macOS infostealer that arrives via terminal command and deploys LaunchAgents to forcibly extract login credentials. When users refuse an initial fake system dialog, the malware kills critical applications every 210 milliseconds until they provide their password. Once captured, it exfiltrates Keychain data, browser credentials, crypto wallets, and Chrome's Safe Storage encryption key, with at least 100 victims across 33 countries since May 2026.","ClickLock macOS stealer forces password entry by killing apps every 210ms until victims comply.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fnew-clicklock-macos-stealer-kills-apps.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj4iNrh8DJbIsaAsGTCFlS4kGWAwdRNMghQm9-o8MV8X2txyJ4iTH1P4g7v5sdjuhw9dOeozn9Q6GenUi4wxBTw9uyoJ1D2j5WIcwCWuTk5XEVyGqjAg4jmP4kOEMp2qtd0BnPiVwrz2MJnTwaAnQP0jR3yCGvojGLQMOEc9syp00LKXIkbjUZrWqh0_GSe\u002Fs1600\u002Fmacos-stealer.jpg","2026-07-16T12:33:42+00:00","2026-07-16T14:00:16.519735+00:00",9,[17,20],{"name":18,"type":19},"Group-IB","vendor",{"name":21,"type":22},"macOS","product","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},[37,40,43,46,49],{"type":27,"value":38,"context":39},"ClickLock","macOS infostealer deployed via terminal command with LaunchAgent persistence",{"type":27,"value":41,"context":42},"ClickFix","Front-end social engineering component using fake Cloudflare CAPTCHA banner",{"type":27,"value":44,"context":45},"com.authirity.plist","LaunchAgent payload executing 210ms kill loop on refused password entry",{"type":27,"value":47,"context":48},"com.chromer.plist","LaunchAgent payload executing 0.2-second kill loop and Keychain query loop",{"type":27,"value":50,"context":51},"script.sh","Orchestrator script disabling keyboard interrupts and pulling four payloads from compromised sites",[18,21],{"controls":54,"vendors":135},[55,83,112],{"slug":56,"name":57,"problem":58,"products":59},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[60,67,75],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":56,"product_name":64,"url":65,"description":66},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":84,"name":85,"problem":86,"products":87},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":113,"name":114,"problem":115,"products":116},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[117,124,130],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":113,"product_name":121,"url":122,"description":123},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":125,"product_name":126,"url":128,"description":129},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":131,"product_name":132,"url":133,"description":134},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[136],{"slug":137,"name":138,"logo_path":139,"roles":140},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[141],"affected",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":160},"clicklock-macos-stealer-coerces-passwords-through-app-killing-pressure-loop","ClickLock macOS Stealer Coerces Passwords Through App-Killing Pressure Loop","ClickLock exploits user psychology by creating an unbearable denial-of-service loop — killing critical applications every 210 milliseconds — until victims surrender their macOS login password to a fake system dialog. The root failure is a combination of insufficient user awareness about social engineering tactics and permissive macOS configuration that allows terminal-installed LaunchAgents to persist and execute with minimal friction. Once the password is obtained, the malware exfiltrates extraordinarily sensitive data including Keychain credentials, browser passwords, crypto wallets, and Chrome's Safe Storage key, effectively compromising the entire credential ecosystem. This attack illustrates how coercive UX manipulation can bypass even security-conscious users who would otherwise reject phishing attempts, making education about pressure-based social engineering critical.",[147,148,149,150,151,152,153,154,155,156,157,158,159],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 14: Security Awareness and Skills Training","CIS Control 18: Penetration Testing","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 AU-12: Audit Record Generation","NIST CSF DE.CM-1: Networks are monitored to detect cybersecurity events","GDPR Article 32: Security of Processing (credential exfiltration of EU subjects)","MITRE ATT&CK T1059.004: Command and Scripting Interpreter – Unix Shell","MITRE ATT&CK T1543.001: Create or Modify System Process – LaunchAgent","MITRE ATT&CK T1555.001: Credentials from Password Stores – Keychain",{}]