'ClickLock' Malware Coerces Mac Users Into Giving Up Passwords

[MacRumors]

Security firm Group-IB has identified a new piece of macOS malware in the wild that pressures users into surrendering their passwords via a barrage of fake system prompts.

Dubbed "ClickLock Stealer," the malware needs no exploits and no elevated privileges to work. Instead, the attack depends on the victim pasting a command into Terminal and running it. The command then executes a script, and everything else follows.

Group-IB did not directly observe how victims are lured into pasting the command, but based on the script's behavior, the firm believes it's served through a fake "ClickFix" page posing as a Cloudflare check or browser verification step. Such pages instruct visitors to copy a command and run it in Terminal as a supposed "verification requirement."

Once it's up and running, the script discreetly downloads several modules and shows a terminal-based loading animation mimicking a Cloudflare progress bar with browser verification. If a user declines the initial password dialog that appears, the malware starts locking system usage.

Specifically, the malware kills every visible app every 210 milliseconds while the password prompt remains on screen, and the rest of the desktop stays unusable until the victim gives in. Meanwhile, another loop suppresses macOS security notifications for roughly six hours.

If the user gives up and enters their password, a second, genuine macOS prompt is subsequently forced to the front, asking them to allow access to a Keychain item. Granting it hands over Chrome's "Safe Storage" AES key, which is what the browser uses to encrypt saved passwords and cookies.

With the login password and Chrome's encryption obtained, ClickLock then harvests browser credentials, Keychain data, password manager vaults, and any cryptocurrency wallets, and then sends it all to a Telegram bot. It also installs a hidden backdoor disguised as an iCloud process to give it continual access.

Group-IB says the campaign has been active since May 2026 and has targeted at least 100 victims across 33 countries. More than half of the victims were in Europe.

Apple has already updated macOS to try to defend against this class of attack before it can get underway. In macOS Tahoe 26.4, it added a warning that appears when the user attempts to paste a command into Terminal from a website, chat, or message, and blocks the paste until the user reviews it. (Opera browser also recently added a similar feature.)

In cases where macOS detects known malware, the paste is blocked outright with no override. Still, it should go without saying that no legitimate website will ever ask a user to paste a command into Terminal.

Article Link: 'ClickLock' Malware Coerces Mac Users Into Giving Up Passwords

 

[turbineseaplane]

the attack depends on the victim pasting a command into Terminal and running it.

Don't be in the Terminal pasting in anything if you don't know what you are doing and why.

👇 this

no legitimate website will ever ask a user to paste a command into Terminal.

 

[axantas]

Why would anyone do that? The main problem is not the malicious website, but the user...

Waiting for an attack like "take a hammer and hit the closed Macbook to unblock the crashed system". I am sure, there will be people, doing that. 😵

 

[melevittfl]

Still, it should go without saying that no legitimate website will ever ask a user to paste a command into Terminal.

That's a rather black and white statement. There are plenty of legitimate websites that host legitimate tools that are installed by pasting into the command line. Off the top of my head, Homebrew, Zsh shell, UV, Pyenv, and nvm, Rust, etc. All aimed at more technical users who, hopefully, can/will evaluate any shell scripts before they run them.

 

[Unregistered 4U]

Fortunately, it’s a non-issue for Apple’s more secure OS’s.

 

[robvalentine]

That's a rather black and white statement. There are plenty of legitimate websites that host legitimate tools that are installed by pasting into the command line. Off the top of my head, Homebrew, Zsh shell, UV, Pyenv, and nvm, Rust, etc. All aimed at more technical users who, hopefully, can/will evaluate any shell scripts before they run them.

I would imagine hope anyone using those tools will be tech savvy and not copy and paste a random command from a fake pop up....

 

[iaynnu]

I'm more interested in how they lure victims to paste something in Terminal. Is this to trick technical users or non technical users?

 

[Unregistered 4U]

I'm more interested in how they lure victims to paste something in Terminal. Is this to trick technical users or non technical users?

Essentially,
“Here’s a thing I have that you want access to, but to get it, paste this in the Terminal.”
Technical user looking at the command: “Who would fall for this? LOL”
non-Technical user: “OK.”

It was probably noticed that people were still falling for “If you want to remove renaissance french from your system, go to the Terminal and type ‘rm -rf’.”

 

[DocMultimedia]

That's a rather black and white statement. There are plenty of legitimate websites that host legitimate tools that are installed by pasting into the command line. Off the top of my head, Homebrew, Zsh shell, UV, Pyenv, and nvm, Rust, etc. All aimed at more technical users who, hopefully, can/will evaluate any shell scripts before they run them.

I would say people using those tools know what they are doing.

My grandmother using the NYT recipe site would not. As was said, if you don't understand what you are typing, don't type it.

 

[switcher3365]

I'm more interested in how they lure victims to paste something in Terminal. Is this to trick technical users or non technical users?

I would say they are mostly targeting non-technical users. I was once trying to look up a local home service and got a CAPTCHA to enter the website. I thought that was strange. It ended up being a fake one that wanted me to paste something to Terminal. Thankfully, I was suspicious about it and stopped from there. I then looked up how to view what was on the clipboard and saw the string of code it wanted me to paste. To this day, I don’t know if the entire website was fake or if a legitimate home service website got hacked.

 

[CarAnalogy]

That's a rather black and white statement. There are plenty of legitimate websites that host legitimate tools that are installed by pasting into the command line. Off the top of my head, Homebrew, Zsh shell, UV, Pyenv, and nvm, Rust, etc. All aimed at more technical users who, hopefully, can/will evaluate any shell scripts before they run them.

I had the same initial thought, but remember, the people who are most vulnerable to this have absolutely no idea what any of that stuff you just said was.

Unless they know enough to know for a fact when that statement is not true, they may as well take it as always true.

 

[dasmb]

Still, it should go without saying that no legitimate website will ever ask a user to paste a command into Terminal.

Sadly there are many engineering and related communities in which this exact task is extremely common, and the commands being issued are likely fairly easy to attack (involving GitHub and other engineering systems with many users having access).

Now it's slightly worse, with many of these commands executed automatically through agentic coding.

As such there's always been a vector for attacks like this supported by a cohort that would otherwise consider themselves savvy users.

 

[svish]

Pasting anything into Terminal window without knowing what one is doing could easily lead to trouble. Apple's warning while pasting commands into the terminal window could help.

 

[tkermit]

Homebrew, Zsh shell, UV, Pyenv, and nvm, Rust, etc. All aimed at more technical users who, hopefully, can/will evaluate any shell scripts before they run them.

I seriously doubt that last part... same thing as running any kind of unsigned code though. At some point it comes down to who you choose to trust.

 

[zeus423]

At some point could this evolve into a website or popup pasting things automatically into Terminal, effectively bypassing the user?

 

[p96]

Maybe the command line environment shouldn't be available by default, or make the default shell something more limited.

The nature of Apple's novice-friendly design gives us a lot more non-technical Mac users than technical.

 

[GrumpyOldGuy52]

I see this a lot on this forum—the assumption that everyone is as tech-savvy as everyone here.

Plenty of users will go and follow the directions they see on the screen because they have been trained to do so by IT pros who don't want to deal with little things. So, before they contact IT or that one family member, they're going to follow the instructions they're presented with.

We need to stop assuming the typical computer user understands how computers work—they don't. That's why training and knowledge management (sharing, not hoarding) are so vital, but many corporations would rather not do that sort of proactive work as it increases expenses, and they would rather not see that… until something like this happens.

So, when you ask "Who would do this?" take a look around you in the real world. The answer is… most of those people would.

 

[DribbleCastle]

Don't be in the Terminal pasting in anything if you don't know what you are doing and why.

👇 this

Good thing my parents don't know how to copy/paste.

 

[mwhite]

"Such pages instruct visitors to copy a command and run it in Terminal as a supposed "verification requirement."

Oh my God, I would never do that!!!!

 

[turbineseaplane]

I don’t know if macOS should ship with Terminal installed by default.

It seems like that would add an extra layer of protection here if you had to go install Terminal before you could even do stuff like this.

 

[Kmac2025]

Hey 👋 I’ve got a terminal script for you to run for some free Claude tokens. Trust me.

 

[Unregistered 4U]

I don’t know if macOS should ship with Terminal installed by default.

It seems like that would add an extra layer of protection here if you had to go install Terminal before you could even do stuff like this.

My prediction, the MacBook Ultra will not ship with Terminal installed by default. But, as a tradeoff, it WILL have access to Netflix and other streaming iPadOS apps and Authenticator apps that are currently only on iPhone/iPad. 😉

 

[Unregistered 4U]

Hey 👋 I’ve got a terminal script for you to run for some free Claude tokens. Trust me.

You know what they say, if it sounds too good to be true, you better not pass it up!

 

[skodises]

Maybe the command line environment shouldn't be available by default, or make the default shell something more limited.

The nature of Apple's novice-friendly design gives us a lot more non-technical Mac users than technical.

I bristled a bit when first reading this comment. However, after a few minutes of reflection on the conversations I've participated in recently, I'm slowly coming around to this way of thinking.

Speaking as a technical user, I've come to the realization that Apple no longer makes products for me. Being a EE, I seem to insist upon doing technical things with my computing hardware, taking responsibility for those things, and wanting to control the machine I own. For example, the first thing I do is to turn off SIP, and enable the root user. My next move will be to take my nice vintage Apple hardware and, at long, long last, switch to Linux. It is time. Let's face it: the pro user is no longer a target demographic for Apple, and realistically that horse stopped kicking back at about Catalina.

Today's Apple wants everything to be a telephone, usable out-of-the-box by the most naive and technically-inexperienced users- and I'm now ready to support that. They should remove the command line environment altogether: it clearly causes more problems than it solves, in the wrong hands.

 

[michaelant]

I'm a little surprised they get anyone to fall for this. Most nontechnical people are going to think it's weird and suspicious that the webpage is telling them to go run "Terminal" that they've never seen or heard of before. I'd hope, anyway. And I'd expect most will balk at that first step.

The only exception I can think of is like mentioned above, where they've had IT previously telling them to open Terminal and do something. So they've had to do this kind of thing before.

And also the completely gullible who will do anything the internet tells them. But I'm surprised those people still have a working computer, or any money, by this point.