ClickLock macOS Malware Coerces Users into Revealing System Passwords, Exfiltrates Credentials
What Happened — Researchers at Group‑IB identified a new macOS‑only information‑stealing malware, dubbed ClickLock, that terminates visible processes and forces a fake system‑password dialog on the user. The script harvests login credentials, password‑manager data, browser cookies, and cryptocurrency wallet information, then exfiltrates it via Telegram. At least 100 systems in 33 countries have been infected since May 2026.
Why It Matters for Compliance & Audit Readiness
- The attack exploits weak access‑control policies and the absence of multi‑factor authentication for local logins – a classic SOC 2 CC6 scenario.
- Continuous monitoring of privileged‑access events (process termination, LaunchAgent creation) provides audit‑ready evidence that such coercion attempts are being detected and blocked.
- Security‑awareness training that covers social‑engineering lures (malicious Terminal commands) is a required control under SOC 2 CC5.
Who Is Affected — Enterprises and professionals using macOS devices across technology, finance, and professional services sectors.
Recommended Actions
- Review and tighten macOS access‑control settings: enforce MFA for local logins, restrict creation of LaunchAgents to approved administrators.
- Deploy endpoint‑detection‑and‑response (EDR) rules that alert on rapid process termination loops and unauthorized LaunchAgent installations.
- Incorporate this coercion technique into security‑awareness curricula and conduct phishing‑simulation drills that include terminal‑command lures.
Source: BleepingComputer
Technical Notes
- Attack vector: social engineering via a malicious Terminal command (“ClickFix” lure) that disables keyboard interrupts and suppresses Notification Center.
- No exploit or elevated privileges required; persistence is achieved through two LaunchAgents (
com.authirity.plist,com.chromer.plist). - Exfiltration channel: Telegram bot API.
Source: Group‑IB analysis