New ClickLock macOS Stealer Kills Every App to Force Password Entry

A newly discovered macOS malware dubbed ClickLock is raising alarms in the cybersecurity community for its aggressive and deceptive credential-harvesting techniques.

According to researchers at Group-IB, the stealer employs a highly disruptive tactic that forcibly terminates running applications, effectively locking users out of their systems to coerce them into entering their macOS password.

ClickLock represents a significant shift in macOS-focused threat activity, combining elements of traditional information stealers with user manipulation strategies more commonly seen in ransomware and scareware campaigns.

This shift mirrors recent trends where Mac endpoints are targeted directly via the web, such as the Atomic Stealer ClickFix attack that works to bypass default system security warnings.

New ClickLock macOS Stealer Kills Every App

Once executed on a target system, ClickLock initiates a series of actions explicitly designed to destabilize the user environment. It systematically kills active processes, including security tools and productivity applications, leaving the system in a near-unusable state.

This forced disruption is immediately followed by the display of a deceptive system prompt that perfectly mimics legitimate macOS authentication dialogs.

Because the request appears authentic and is presented during a moment of high system instability, users are far more likely to comply out of a desire to restore functionality. The entered credentials are then captured and transmitted directly to the attacker-controlled command-and-control infrastructure.

Group-IB researchers note that ClickLock leverages AppleScript and native macOS utilities to carry out its operations, allowing it to blend into legitimate system activity and evade basic signature-based detection mechanisms.

The malware does not rely on sophisticated exploits or zero-day vulnerabilities; instead, it capitalizes entirely on social engineering and user trust in system prompts. This approach of using basic system utilities to stay silent matches the quieter installation updates seen in recent waves of competing Mac stealer families.

Malware Feature	Implementation Mechanism	Core Security Objective
Process Termination	Loop killing active processes	Induce system instability to panic the user
Deceptive Prompting	Spoofed AppleScript dialog windows	Harvest the primary macOS login password
Environmental Recon	Native utility calls	Collect hardware and environment metadata

In addition to harvesting credentials, ClickLock is capable of collecting broad system information, including device details and user environment data. This information can be used to tailor further downstream attacks or sold on underground cybercrime marketplaces.

The modular nature of the malware strongly suggests potential for future expansion, including the addition of automated data exfiltration or advanced persistence mechanisms.

“The effectiveness of ClickLock lies in its simplicity. By creating a controlled disruption and presenting a believable system prompt, the malware bypasses technical defenses and directly targets human behavior.”

While the exact infection vector for ClickLock has not been definitively confirmed, researchers strongly suspect distribution through trojanized applications, malicious downloads, or targeted phishing campaigns.

As macOS adoption continues to expand inside enterprise environments, threat actors are increasingly investing in platform-specific malware to exploit perceived gaps in user vigilance.

To mitigate the risk posed by ClickLock and similar threats, organizations are advised to enforce the following behavioral guidelines:

• Prompt Verification: Avoid entering credentials into unexpected or suspicious prompts, especially immediately following abnormal system behavior.
• Behavioral Detection: Maintain endpoint protection solutions with advanced behavioral detection capabilities to catch process-killing loops.
• Verify System Behavior: Double-check the legitimacy of authentication requests and report forced application crashes to security teams.

The emergence of ClickLock underscores the rapidly evolving threat landscape for macOS systems, highlighting that the platform is no longer a low-priority target for cybercriminals.

As attackers refine their tactics by combining system-level disruption with credential theft, defenders must adapt by strengthening both technical controls and user awareness.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.