A new ClickLock macOS malware campaign never breaks into your Mac at all — it convinces you to do the work yourself. The lure is a fake “verify you’re human” page dressed up as a Cloudflare check, telling you to copy a command and paste it into Terminal to prove you’re not a bot. Do that once, and your Mac is compromised — no exploit, no security hole, just your own paste-and-run.
ClickLock is a credential-and-cryptocurrency stealer flagged by security firm Group-IB. A sample was uploaded to VirusTotal on June 9, 2026 with zero antivirus detections at the time. The campaign has been running since May 2026, and Group-IB has already tied it to at least 100 victims across 33 countries, more than half of them in Europe. What makes it notable isn’t clever code — as Group-IB analyst Boris Martynyuk put it, “the malware doesn’t even need any elevated privileges or rely on exploits for successful execution.”
How the ClickLock macOS malware con works
You land on a page that looks like a routine bot check, and it instructs you to paste a command into Terminal to “verify.” The moment you run it, the script plays a fake loading animation, silences your Mac’s notifications for about six hours, and quietly pulls down more malicious pieces in the background.
Then the coercion starts. ClickLock throws up a fake macOS password box — using your real username and the genuine Apple icon — and begins a “kill loop,” force-quitting Finder, the Dock, Terminal, Activity Monitor, System Settings and your browsers roughly every 210 milliseconds. Your desktop becomes unusable, and it can keep this up for up to around three and a half days until you crack and type your real password into the fake prompt. “The victim gets forced to follow the attack flow and enter a password,” Martynyuk said, “because otherwise malware ‘locks’ the system usage.”
Once it has your login, it fires a second, legitimate-looking Keychain prompt to unlock Chrome’s password encryption, nagging repeatedly if you refuse. From there it grabs browser logins and cookies, password-manager vaults, cryptocurrency wallet extensions and desktop wallet files, and saved FTP credentials, then ships them out over the Telegram Bot API. Worse, it leaves behind a persistent backdoor (a modified build of the open-source tool GSocket) that survives the theft, giving the attacker a standing remote shell into your machine.
If this sounds familiar, it should. Five days ago we covered CrashStealer, a different Mac malware that fakes a crash-report password prompt. ClickLock is a different family with a different pretext, but the underlying con is identical: make a fake dialog look official so you hand over your password.
Apple already built a defense — in macOS Tahoe 26.4
Here’s the genuinely useful part. Apple shipped a guard against this exact class of attack in macOS Tahoe 26.4, released in March 2026. When you copy a command from a browser or chat app and try to paste it into Terminal, macOS now steps in. Per Apple’s own support documentation, there are two tiers:
- Suspicious paste: a “Possible malware, Paste blocked” warning explains that scammers often push people to paste text into Terminal — but you can override it with a “Paste Anyway” button and continue.
- Known-malware paste: a “Malware Detected, Paste Blocked” or “Malicious Script Blocked” message appears, and here there is no “Paste Anyway” option. The paste is refused outright.
Don’t mistake this for “Apple has you covered”
The warning is a real safety net, but only as strong as your own skepticism. For a merely-suspicious command, one hurried click on “Paste Anyway” reopens the whole attack — exactly what a page designed to mimic official verification is counting on. It also only exists if you’re on Tahoe 26.4 or later; older Macs get no warning at all.
The defense that actually holds is behavioral: never paste a command from a web page, chat, or email into Terminal to “verify,” “fix,” or “unlock” anything. Legitimate human-verification checks, from Cloudflare or anyone else, never ask you to open Terminal. If a site tells you to, that page is the scam, no matter how polished it looks.
What to do right now
- Check your macOS version. Open the Apple menu > About This Mac and confirm you’re on macOS Tahoe 26.4 or later (26.5 has since shipped) so the Terminal paste warning is active. If you’re behind, update.
- Adopt the one rule. Any web page, message, or email that asks you to paste something into Terminal to prove you’re human or fix an error is malicious by default. Close it.
- If you already ran the command: if the Mac is unresponsive, force it to restart into Safe Mode, then change your Mac login password and every password saved in your browsers and password managers, and check your crypto wallet extensions and accounts for unauthorized activity.
That last step is damage control, not a cleanup. Because ClickLock leaves a persistent backdoor, a fully compromised Mac is best wiped and restored from a known-clean backup — or handed to a professional — rather than trusted after a password change alone.
