ClickLock macOS Stealer Forces Password Prompts and Installs GSocket Backdoor
Summary
Group-IB reports that ClickLock uses fake verification and repeated password prompts to steal macOS credentials and other data. Researchers say it affected at least 100 systems in 33 countries and can install a persistent GSocket backdoor.
Key points
- Group-IB says ClickLock likely spreads through a ClickFix lure that tricks users into running a malicious Terminal command disguised as Cloudflare verification.
- The malware suppresses notifications and terminates visible apps to pressure victims into entering their macOS password or approving Keychain access.
- It harvests browser data, credentials, wallet information, password-manager data, shell histories, and other system information, then uploads collected data through Telegram’s Bot API.
- ClickLock uses macOS LaunchAgents for persistence; its modified GSocket component can also persist through crontab and shell-configuration changes to provide remote access.
- Researchers reported at least 100 affected systems across 33 countries. The script was not detected by VirusTotal vendors at the time of their report.
- Group-IB says detection may be possible by monitoring password-dialog launches, repeated process termination, bulk access to browser profiles, and outbound connections to Telegram’s API.
Article Details
- Attack Vectors
- A ClickFix-style lure prompts macOS users to paste a malicious command into Terminal, triggering a fake Cloudflare verification flow and downloading stealer modules.
- ClickLock uses fake macOS password dialogs and repeated termination of visible applications to coerce users into entering their login password.
- If the user cancels the password dialog, ClickLock establishes persistence with LaunchAgents and prompts for Keychain authorization to access Chrome Safe Storage.
- The malware collects browser, wallet, password-manager, shell-history, FileZilla, and system data, packages it into a ZIP archive, and uploads it through the Telegram Bot API.
- A modified GSocket component establishes persistence through a LaunchAgent, crontab entries, and shell configuration changes, then uses a GSocket relay for reverse-shell access.
- Defensive Notes
- Do not paste Terminal commands that you do not understand, especially when prompted by a website.
- If a password prompt appears while the rest of the system is unresponsive, Group-IB recommends forcing a shutdown and booting into Safe Mode.
- Detection opportunities cited by the researchers include osascript launching password dialogs, repeated process termination, mass access to browser profile directories, and outbound connections to Telegram's API.
MITRE ATT&CK
T1005 · Data from Local SystemClickLock harvests local browser, wallet, password-manager, shell-history, and FileZilla data.T1053.003 · CronThe GSocket backdoor adds crontab entries as a persistence method.T1056.002 · GUI Input CaptureThe malware displays fake macOS password dialogs and captures the password entered by the user.T1059.004 · Unix ShellThe GSocket backdoor provides a reverse shell for remote control of infected systems.T1105 · Ingress Tool TransferStealer modules are downloaded in the background during the fake verification sequence.T1204.004 · Malicious Copy and PasteThe ClickFix lure tricks users into pasting a malicious command into macOS Terminal.T1543.001 · Launch AgentClickLock and its GSocket backdoor use macOS LaunchAgents for persistence.T1546.004 · Unix Shell Configuration ModificationThe GSocket backdoor modifies shell configuration files to persist.T1555.001 · KeychainA ClickLock mechanism requests Keychain authorization to access Chrome's Safe Storage key.T1555.003 · Credentials from Web BrowsersThe harvesting module collects saved logins and other data from browser profiles.T1567 · Exfiltration Over Web ServiceThe malware uploads collected data to attackers through the Telegram Bot API.
Malware
Products
Google Chromerequesting Keychain authorization via a legitimate system prompt, seeking approval to access Chrome’s Safe Storage key.macOSClickLock is a new macOS info-stealer that uses fake Cloudflare verification and forced password prompts to steal credentials, cryptocurrency data, browser information, and macOS authentication data.