ClickLock: the macOS stealer that holds your apps hostage

There's a new macOS infostealer doing the rounds, and its selling point is coercion. ClickLock, written up this week by Group-IB, arrives the way most of these things arrive lately: a command pasted into Terminal from a ClickFix lure dressed as a Cloudflare CAPTCHA check. The interesting bit is what happens if you say no.

Cancel the fake password dialog and the malware doesn't give up. It quietly writes two LaunchAgents to disk and waits. At your next login, Finder, the Dock, Spotlight, Terminal, Activity Monitor and every major browser start dying in a loop every 210 milliseconds. For up to 83 hours. The desktop becomes unusable. All that's left on screen is a password prompt.

Type it and the machine is stripped. Keychain, browser credentials, cookies, crypto wallets, password manager vaults, shell history, FileZilla logins. A separate loop kills NotificationCenter for six hours so Gatekeeper's warnings never render while the payload runs.

Small, quiet, and quite successful

Group-IB counts around 100 victims across 33 countries since May, more than half in Europe. The orchestrator script sat on VirusTotal for weeks with zero detections. Analysts recovered the full payload chain but never located the lure page itself, so how people are being funnelled to the paste command in the first place is still open.

A backdoor called goyim, mostly borrowed from the open-source GSocket toolkit, stays behind as a reverse shell. It lives at ~/Library/Application Support/iCloudsync and runs under the process name SystemUIServerl, one letter off the real system process. If you scanned Activity Monitor in a hurry you would not spot it.

Apple's mitigation, and the workarounds

To be fair to Apple, they shipped a mitigation for exactly this class of attack in macOS 26.4 back in March. Terminal warns when it sees a suspicious paste, and known malware is blocked outright. There are two problems with that:

• The warning only fires if you don't regularly use Terminal. Developers and admins, the people most likely to have valuable Keychain contents, see nothing.
• The warning ships with a Paste Anyway button, which does exactly what it says.

ClickLock's operators launched a month after that mitigation shipped and built around it. A separate April campaign documented by Jamf sidesteps the warning entirely by using an applescript:// URL to preload the payload into Script Editor, which isn't covered by the Terminal check.

If it happens to you

Group-IB's advice, if you find yourself watching your Mac murder its own applications on a loop: don't type the password. Hold the power button until it shuts down, boot into Safe Mode, and treat every saved credential, cookie and wallet key on that machine as already gone. The Chrome Safe Storage AES key in particular is decrypted at the attacker's leisure, offline, whenever they get around to it. You will not get a warning when they do.

The bigger point, and it applies well beyond macOS, is that the attack doesn't need a zero-day or a clever exploit chain. It needs one person, at one moment, to paste a command they didn't write into a Terminal they didn't ask to open. That's the whole vulnerability.