New Click Lock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password
Summary: ClickLock Stealer, a new macOS infostealer, arrives as a command pasted into Terminal and, when the victim cancels the fake password dialog, installs two LaunchAgents that kill Finder, Dock, Spotlight, Terminal, Activity Monitor and major browsers every 210 milliseconds for up to 83 hours until the login password is entered. Group-IB counts at least 100 targets across 33 countries since May, over half in Europe, and its analysts never found the lure pages, only three compromised payload hosts.
Key Takeaway: A completed run hands the operator the validated macOS login password and Chrome's Safe Storage AES key, which decrypts saved passwords and cookies offline on the attacker's machine whenever they choose, so every credential on a hit machine has to be treated as gone. Group-IB's own assessment is that the sub-second kill loops have no legitimate use case, and the malware was built specifically for the user who refuses.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026