ClickLock Stealer is a macOS malware discovered by Group-IB that bypasses macOS security protections through social engineering and process killing. It targets web browsers, cryptocurrency wallets, password managers, macOS Keychain, FTP credentials, and shell history. Distribution likely involves SEO poisoning, social media, or compromised websites leading victims to execute a malicious bash command. The malware runs an orchestrator script that downloads four additional scripts for credential stealing, cryptocurrency stealing, Keychain access, and backdoor installation. It aggressively kills processes, including NotificationCenter, to suppress security warnings and forces victims to enter passwords via fake dialogs. The malware exfiltrates stolen data to a Telegram bot and maintains persistence via a backdoor. It does not use exploits or privilege escalation but relies on victim execution and coercion.

The malware compromises user credentials, cryptocurrency wallets, and sensitive system data by coercing users to execute malicious scripts and grant access to protected resources. It can steal passwords stored in browsers and the macOS Keychain, harvest blockchain addresses, and capture FTP credentials and shell history. The backdoor installed allows persistent access to the compromised system. This results in significant data theft and potential financial loss for victims.

No official patch or fix is available as this malware relies on social engineering and user execution rather than exploiting software vulnerabilities. Users should avoid executing untrusted commands in the Terminal and be cautious of suspicious websites or social media links. macOS built-in protections are bypassed by user consent and process killing, so user education and awareness are critical. Endpoint security solutions may help detect suspicious behavior but cannot prevent user-driven execution. Monitor for unusual process terminations and unexpected password prompts. Since the malware suppresses notifications, users should be vigilant for abnormal system behavior.