---
title: "ClickLock: New macOS Malware Steals Passwords and Crypto via Fake Login Screen"
description: "🚨 New ClickLock malware for macOS steals passwords and crypto via a fake login screen. Over 100 devices in 33 countries are already infected. ⚠️ Be careful with terminal commands!"
date: 2026-07-18T13:43:55.000Z
lang: en
url: https://xab.info/en/posts/clicklock-new-macos-malware-steals-passwords-and-crypto-via-fake-login-screen
tags: [clicklock, macos, group-ib, malware, cybersecurity]
publisher: "XAB.info"
---

# ClickLock: New macOS Malware Steals Passwords and Crypto via Fake Login Screen

![Hacker silhouette surrounded by digital warnings and binary code — visualizing ClickLock macOS malware threat](https://xab.info/media/2026/07/18/clicklock-novoe-vredonosnoe-po-dlya-macos-kradet-paroli-i-kriptovalyutu/clicklock-novoe-vredonosnoe-po-dlya-macos-kradet-paroli-i-kriptovalyutu-1.webp)

Security experts from Group-IB have discovered a new threat for macOS users — malware named ClickLock. The program is designed to steal cryptocurrency assets, browser data, password managers, and other confidential information. According to BleepingComputer, at least 100 devices in 33 countries have already been infected.

### How does ClickLock work?

ClickLock is a shell script containing a set of malicious commands. Infection begins via a ClickFix scheme — a social engineering method that prompts the user to enter a command in the terminal under the guise of a Cloudflare "human verification" with an animated progress bar.

Once launched, the script performs the following actions:

  - Disables keyboard shortcuts;

  - Hides the cursor in the terminal;

  - Disables the macOS Notification Center for approximately six hours;

  - Downloads additional modules.

Then, a fake macOS password entry window appears on the screen, containing the real username and the Apple logo. If a password is entered, it is verified and sent to attackers via a Telegram bot API.

### What happens if the user refuses to enter the password?

If the user refuses to enter the password, ClickLock embeds itself into the system using a LaunchAgent — a special background script. After the next macOS login, the malware terminates key processes every 210 milliseconds: the Finder file manager, the Dock panel, web browsers, and other system components. Only the password entry window remains on the screen. This cycle can last for about 83 hours or until the correct password is entered.

Additionally, a second LaunchAgent requests access to the "Keychain" every 200 milliseconds to gain access to the encrypted security key (Chrome Safe Storage).

### What data does ClickLock steal?

The malware collects data from Chrome, Firefox, Brave, Edge, Opera, Vivaldi, Arc, and Chromium browsers, including:

  - Saved passwords;

  - Cookie files;

  - Autofill data;

  - Bookmarks;

  - Local storage.

Furthermore, ClickLock steals cryptocurrency wallet data, password manager extensions, shell command history, FileZilla configuration, system information, and the public IP address. The collected information is archived into a ZIP file and transmitted to attackers via Telegram. Files larger than 40 MB are automatically split into parts.

### How to protect yourself from ClickLock?

According to Group-IB experts, detecting this malware is difficult due to the use of compromised legitimate domains and the self-destruction of most modules after execution. To protect themselves, researchers recommend:

  - Do not execute commands in the terminal if their origin is unknown;

  - If a password entry window appears simultaneously with a system freeze, force shut down the computer by holding the power button;

  - Boot macOS in Safe Mode.