ClickLock macOS Stealer Forces Password Entry by Killing Apps Every 210 ms
What Happened — ClickLock is a newly identified macOS infostealer that, after a victim runs a malicious command in Terminal, repeatedly terminates core macOS applications (Finder, Dock, Spotlight, etc.) every 210 ms until the user supplies the login password via a spoofed dialog. The malware then installs two LaunchAgents to persist across reboots and exits silently.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a failure of access‑control policies and security‑awareness controls that SOC 2 expects organizations to enforce and evidence.
- Highlights the need for continuous monitoring of privileged command execution and evidence of user‑training effectiveness as part of the CC6.1 – Logical Access Controls and CC7.2 – Security Awareness criteria.
- Aligns directly with Verisq’s Security Awareness capability, which provides audit‑ready training records and automated proof of policy adherence.
Who Is Affected — Any organization with macOS endpoints, notably technology firms, financial services, and professional services that rely on privileged macOS workstations.
Recommended Actions
- Map this incident to SOC 2 CC6.1 (Logical Access) and CC7.2 (Security Awareness) controls; collect evidence of policy enforcement and training completion.
- Enforce strict execution policies (e.g., approved‑script whitelisting) and disable Terminal paste‑exec for non‑admin users.
- Deploy MFA for local macOS admin accounts and monitor for unauthorized LaunchAgents.
- Refresh security‑awareness curricula to cover command‑line social engineering and the dangers of unknown Terminal commands.
Source: The Hacker News
Technical Notes — The malware is delivered via a copy‑and‑paste command, creates two LaunchAgents for persistence, and leverages a fake system dialog to harvest the user’s password. No CVE is involved; the attack vector is social engineering via Terminal. Source: same as above