ClickLock Stealer is a modular information stealer targeting macOS systems. It is distributed through social engineering via ClickFix pages that convince users to paste malicious commands into Terminal. Upon execution, it installs four main components: a credential stealer, a Keychain stealer focusing on Chrome encryption keys, a crypto wallet harvester covering 31 wallet extensions and desktop wallets, and a persistent backdoor using GSocket. The malware employs an aggressive locker technique that kills all visible applications except password dialogs to force user interaction. It targets data from eight browsers, seven password managers, macOS Keychain, shell history, and cryptocurrency wallets. The campaign has affected at least 100 victims in 33 countries since May 2026, leveraging compromised WordPress domains and Telegram for command and control and data exfiltration.

The malware compromises sensitive user data including browser credentials, password manager data, macOS Keychain secrets, shell history, and cryptocurrency wallets. The persistent backdoor allows ongoing unauthorized access. The aggressive locker technique disrupts normal system use, potentially coercing users into further compromising actions. The campaign has resulted in at least 100 confirmed infections across multiple regions, indicating active targeting and data theft.

No official patch or remediation is available as this is malware distributed via social engineering. Mitigation focuses on user education to avoid pasting untrusted commands into Terminal and monitoring for suspicious activity. Organizations should block known malicious domains and URLs associated with the malware's infrastructure. Endpoint detection and response solutions should be updated to detect the malware components and associated indicators of compromise. Since this is not a vulnerability in software but malware infection, prevention relies on user awareness and network defenses.