Malware

ClickLock

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The malware does not rely on sophisticated exploits or zero-day vulnerabilities; instead, it capitalizes entirely on social engineering and user trust in system prompts.

Execution

4 techniques

T1059.004Unix ShellEvidence1

Group-IB analyzed the ClickLock shell script

T1106Native APIEvidence1

ClickLock leverages AppleScript and native macOS utilities to carry out its operations, allowing it to blend into legitimate system activity and evade basic signature-based detection mechanisms.

T1204User ExecutionEvidence1

The compromise likely begins via a ClickFix lure, as the researchers observed pastes of a malicious command in the Terminal that trigger a fake Cloudflare “human verification” sequence with an animated progress bar.

T1204.002Malicious FileEvidence1

Persistence

1 technique

T1556Modify Authentication ProcessEvidence1

shows only a password dialog on the screen until the victim complies

Stealth

2 techniques

T1036MasqueradingEvidence2

This forced disruption is immediately followed by the display of a deceptive system prompt that perfectly mimics legitimate macOS authentication dialogs.

T1070.004File DeletionEvidence1

its modules self-delete after execution, leaving no artifacts

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

shows only a password dialog on the screen until the victim complies

Credential Access

5 techniques

T1056Input CaptureEvidence2

This forced disruption is immediately followed by the display of a deceptive system prompt that perfectly mimics legitimate macOS authentication dialogs... The entered credentials are then captured and transmitted directly to the attacker-controlled command-and-control infrastructure.

T1539Steal Web Session CookieEvidence1

Saved logins, cookies, autofill data, bookmarks, local storage, and session storage

T1555Credentials from Password StoresEvidence1

requesting Keychain authorization via a legitimate system prompt, seeking approval to access Chrome’s Safe Storage key. That key could then be used to decrypt offline Chromium-stored passwords, cookies, and autofill information from stolen databases.

T1556Modify Authentication ProcessEvidence1

shows only a password dialog on the screen until the victim complies

T1649Steal or Forge Authentication CertificatesEvidence1

requesting Keychain authorization via a legitimate system prompt, seeking approval to access Chrome’s Safe Storage key

Discovery

1 technique

T1082System Information DiscoveryEvidence2

In addition to harvesting credentials, ClickLock is capable of collecting broad system information, including device details and user environment data.

Collection

3 techniques

T1005Data from Local SystemEvidence1

ClickLock also deploys a data-harvesting module, which targets the following: Data from eight browsers... Cryptocurrency wallet extensions and desktop wallet files... Shell histories... FileZilla FTP configuration

T1056Input CaptureEvidence2

T1560Archive Collected DataEvidence1

The harvesting module packages the collected information and a summary log file into a ZIP archive, then uploads it via the Telegram Bot API.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence1

If the user enters their password, the malware validates the data and exfiltrates it to the attacker via Telegram.

Other

1 technique

T1562Impair DefensesEvidence1

At the same time, keyboard interrupts are disabled, the terminal cursor is hidden... The macOS NotificationCenter is also suppressed for about six hours, effectively disabling notifications that could expose the attack.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyber security newsNews

Jul 17, 2026

New ClickLock macOS Stealer Kills Every App to Force Password Entry

A macOS stealer that forcibly terminates running applications to destabilize the system, displays spoofed macOS authentication prompts to trick users into entering their password, captures those credentials, and transmits them to attacker-controlled infrastructure. It also collects device and environment metadata and uses AppleScript and native macOS utilities to blend into normal activity.

bleeping computerNews

Jul 16, 2026

New ClickLock macOS malware traps users into revealing login password

macOS malware that uses ClickFix-style social engineering and forced interaction loops to coerce victims into entering their system password, steals credentials, browser data, password-manager data, cryptocurrency wallet material, shell histories, and other system information, exfiltrates data via Telegram, and can install persistence plus a remote-access backdoor.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

ClickLock

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The malware does not rely on sophisticated exploits or zero-day vulnerabilities; instead, it capitalizes entirely on social engineering and user trust in system prompts.

Execution

4 techniques

T1059.004Unix ShellEvidence1

Group-IB analyzed the ClickLock shell script

T1106Native APIEvidence1

ClickLock leverages AppleScript and native macOS utilities to carry out its operations, allowing it to blend into legitimate system activity and evade basic signature-based detection mechanisms.

T1204User ExecutionEvidence1

T1204.002Malicious FileEvidence1

Persistence

1 technique

T1556Modify Authentication ProcessEvidence1

shows only a password dialog on the screen until the victim complies

Stealth

2 techniques

T1036MasqueradingEvidence2

This forced disruption is immediately followed by the display of a deceptive system prompt that perfectly mimics legitimate macOS authentication dialogs.

T1070.004File DeletionEvidence1

its modules self-delete after execution, leaving no artifacts

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

shows only a password dialog on the screen until the victim complies

Credential Access

5 techniques

T1056Input CaptureEvidence2

T1539Steal Web Session CookieEvidence1

Saved logins, cookies, autofill data, bookmarks, local storage, and session storage

T1555Credentials from Password StoresEvidence1

T1556Modify Authentication ProcessEvidence1

shows only a password dialog on the screen until the victim complies

T1649Steal or Forge Authentication CertificatesEvidence1

requesting Keychain authorization via a legitimate system prompt, seeking approval to access Chrome’s Safe Storage key

Discovery

1 technique

T1082System Information DiscoveryEvidence2

In addition to harvesting credentials, ClickLock is capable of collecting broad system information, including device details and user environment data.

Collection

3 techniques

T1005Data from Local SystemEvidence1

T1056Input CaptureEvidence2

T1560Archive Collected DataEvidence1

The harvesting module packages the collected information and a summary log file into a ZIP archive, then uploads it via the Telegram Bot API.

Exfiltration

1 technique

T1567Exfiltration Over Web ServiceEvidence1

If the user enters their password, the malware validates the data and exfiltrates it to the attacker via Telegram.

Other

1 technique

T1562Impair DefensesEvidence1

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cyber security newsNews

Jul 17, 2026

New ClickLock macOS Stealer Kills Every App to Force Password Entry

bleeping computerNews

Jul 16, 2026

New ClickLock macOS malware traps users into revealing login password

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.