ClickLock Mac malware locks apps until you give in
ClickLock is a Mac malware that uses deceptive web pages and fake Terminal prompts to compromise systems. Victims encounter a fraudulent verification page instructing them to run a command in Terminal, which covertly installs malicious software whilst displaying a fake progress bar. The malware then displays spoofed password dialogs that repeatedly close applications until the user surrenders their login credentials, rendering the system unusable.
Cybersecurity researchers at Group-IB discovered the malware after it was first uploaded to VirusTotal in June 2026, though security tools initially failed to detect it. The campaign has targeted approximately 100 systems across 33 countries since May. Beyond stealing passwords and browser data, ClickLock extracts cryptocurrency wallet information and can install persistent backdoors enabling remote system control by attackers.
- ClickLock malware tricks Mac users into running Terminal commands via fake verification pages, covertly installing malicious software
- Once installed, the malware steals passwords, browser data, and crypto wallets while forcibly closing applications until credentials are entered
- First discovered June 2026, the campaign has compromised ~100 systems across 33 countries; security tools initially failed to detect it