Hackers Use Paste-and-Run Commands to Deploy ClickLock Stealer Against Mac Users

Hackers are actively targeting macOS users with a newly identified infostealer dubbed “ClickLock Stealer,” leveraging paste-and-run social engineering techniques to bypass Apple’s native security protections without requiring exploits or elevated privileges.

Despite macOS protections such as Gatekeeper, Transparency, Consent, and Control (TCC), System Integrity Protection (SIP), and mandatory code signing, threat actors are increasingly deploying modular stealers such as Atomic Stealer (AMOS), Banshee, Poseidon, Cuckoo, Cthulhu, and MacStealer.

ClickLock represents a new evolution in this ecosystem, combining ClickFix-style delivery with coercive “locker” behavior to force user compliance.

The malware was first observed in a malicious shell script uploaded to VirusTotal on June 9, 2026, with zero detections at the time of discovery, indicating its novelty and potential evasion capability.

Researchers assess with high confidence that the distribution relies on ClickFix phishing pages fake verification portals that trick users into copying and executing terminal commands under the guise of browser validation, often mimicking Cloudflare CAPTCHA workflows.

This technique mirrors earlier campaigns documented by Microsoft and Malwarebytes involving fraudulent macOS utilities and verification prompts.

While the exact infection vector remains unconfirmed, likely sources include SEO poisoning, compromised WordPress sites, and social media-driven phishing lures.

The malware infrastructure heavily relies on compromised domains such as panalobet[.]ph and Telegram bots for command-and-control and data exfiltration.

The attack is orchestrated through a primary script that downloads multiple modules, including credential stealers, a Keychain extractor, a cryptocurrency data harvester, and a GSocket-based backdoor.

Notably, components are executed both in-memory and via hidden directories to evade detection.

A key innovation is the malware’s coercive execution model. If the user refuses to provide credentials, the malware enforces compliance by repeatedly terminating system processes, effectively locking the interface and leaving only password prompts visible.

Group-IB said in a report shared with GBhackers, highlights a growing shift in macOS threat activity where user interaction not software vulnerabilities serves as the primary attack vector.

This “locker” mechanism ensures eventual credential capture without exploiting system vulnerabilities.

The malware also suppresses macOS security notifications for extended periods and manipulates timestamps to hinder forensic analysis. Persistence is achieved through LaunchAgents, enabling re-execution after reboot if initial attempts fail.

ClickLock Stealer Against Mac Users

ClickLock Stealer targets a wide range of sensitive data, including macOS login credentials, Keychain data, Chrome encryption keys, browser-stored passwords, and cryptocurrency wallet information.

ClickLock Stealer begins execution when a victim pastes a malicious command into macOS Terminal. The script displays a fake “Cloudflare CAPTCHA Access Control” interface with a convincing progress animation to maintain user trust.

It supports extraction from Chromium-based browsers, Firefox, and over 30 wallet extensions such as MetaMask, Phantom, Coinbase Wallet, and Trust Wallet.

The malware also scans for desktop wallet applications like Electrum, Exodus, and Bitcoin Core, while harvesting shell history and FTP credentials.

Extracted data is archived and exfiltrated via Telegram bots, enabling attackers to decrypt browser data offline and maintain persistent access.

A modified version of the open-source GSocket tool is deployed as a persistent backdoor, providing reverse shell access disguised as legitimate system processes.

The backdoor connects to attacker-controlled infrastructure and survives system reboots, unlike other modules that self-delete after execution.

Code analysis indicates approximately 80% reuse of the original GSocket deployment script, suggesting rapid weaponization of open-source tooling.

Group-IB telemetry indicates that the campaign has been active since May 2026, impacting at least 100 victims across 33 countries. More than half of the victims are located in Europe, with additional activity observed in North America, the Middle East, and Africa.

The targeting focus on cryptocurrency wallets and password managers suggests financially motivated operations, prioritizing users with high-value digital assets.

ClickLock Stealer underscores a critical shift in macOS threat models: attackers no longer need zero-day exploits or privilege escalation to achieve full compromise.

Instead, they exploit user trust and interface manipulation to execute complex, multi-stage attacks.

An example scenario illustrates the simplicity of the attack: a user visiting a fake verification page is instructed to paste a command into Terminal to “prove they are not a bot.”

Within seconds, the system begins exfiltrating credentials while displaying a benign progress animation, leaving the victim unaware of the compromise.

The discovery reinforces the growing importance of user awareness and behavioral detection in defending macOS environments, as adversaries continue to refine social engineering techniques combined with modular, stealthy malware architectures.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide