New macOS Malware Kills Your Apps Every 210ms Until You Hand Over Your Password

A newly discovered macOS infostealer named ClickLock is terrorizing victims across 33 countries by systematically destroying their desktop environment until they surrender their login credentials — and it has been active since May 2026.

Cybersecurity firm Group-IB uncovered the malware and published its findings after analyzing a payload uploaded to VirusTotal on June 9. The orchestrator script had zero detections when Group-IB examined it. The firm has since counted at least 100 confirmed targets across 33 countries, with more than half located in Europe.

ClickLock represents a disturbing evolution in macOS-targeted malware. Rather than quietly harvesting data in the background, it weaponizes user frustration itself — engineering a coercive loop that leaves victims with a dead desktop and a single password box, betting that most people will simply give in. To understand where ClickLock sits in the broader threat landscape, it helps to have a working knowledge of the different types of malware and how they operate — because ClickLock deliberately blurs the line between infostealer and coercive ransomware-style behavior.

---

How the Attack Works

The infection begins with a ClickFix-style lure. The victim pastes a command into Terminal — a social engineering technique that has become increasingly common in macOS-targeted campaigns. The script immediately disables keyboard interrupts, hides the cursor, and presents a fake Cloudflare CAPTCHA banner cycling through twelve status lines over ten seconds. Neither the banner nor the progress bar does anything functional. They exist purely to reassure someone who just pasted a command into their own machine.

A fake system dialog then appears, styled with a downloaded Apple icon and the victim's real username, requesting their login password. If the victim cancels, the malware does not give up.

Instead, the script drops two LaunchAgents into ~/Library/LaunchAgents/ and quietly exits. At the next login, the assault begins. Finder, the Dock, Spotlight, Terminal, Activity Monitor, and all major browsers begin dying every 210 milliseconds. A separate loop runs at 0.2-second intervals for up to 3,000,000 seconds — roughly 34.7 days. NotificationCenter is killed for six hours so no Gatekeeper warning can render on screen. Activity Monitor and Terminal are both on the kill list, removing the two tools most users would reach for to diagnose the problem.

One password box remains on the otherwise dead desktop.

Group-IB is unambiguous about what this behavior represents: "This behavior is unique to forced-interaction malware and has no legitimate use case."

The Psychological Architecture Behind the Attack

What makes ClickLock genuinely novel is not its technical complexity — it is the deliberate engineering of psychological collapse. The malware does not need to bypass any security controls after the initial infection. It simply makes the computer unusable until the user provides what it wants. Every element is designed to eliminate alternatives: Terminal is dead, Activity Monitor is dead, notifications are suppressed. The victim is left in an environment that appears to be malfunctioning catastrophically, with a single apparent path to resolution. This is coercion, not exploitation — and it requires no vulnerability in macOS to execute.

---

What Happens When You Type the Password

The password is validated against dscl /Local/Default -authonly before anything is sent. Only a working credential is worth exfiltrating. Once confirmed, the operator receives:

• The validated macOS login password
• Chrome's Safe Storage AES key
• A ZIP archive containing browser credentials and cookies, crypto wallet extension storage, desktop wallet files, password manager vaults, the macOS Keychain, shell history, and FileZilla's saved server credentials

The Safe Storage key is particularly dangerous. It encrypts Chrome's saved passwords and cookies on disk, meaning the attacker can decrypt Login Data and Cookies offline at any time after the fact — on their own machine, at their leisure. This is one reason why adopting stronger password security practices — particularly moving away from browser-native credential storage — matters well before any infection occurs.

Exfiltration routes through three Telegram bots. Group-IB observed no dedicated command-and-control infrastructure. The stealer payloads themselves sit on three compromised domains with clean reputations, including at least one hacked WordPress site.

The Backdoor Nobody Notices

A backdoor component named goyim is also installed. Group-IB assessed it as roughly 80 percent a copy of the public deployment script for GSocket, an open-source tunneling toolkit. The binary lands disguised as iCloud inside ~/Library/Application Support/iCloudsync and runs as a process named SystemUIServerl — one letter off the legitimate macOS process name.

Unlike the stealer modules, the backdoor does not clean up after itself. A victim who types their password and watches their desktop return to normal may have no visible indication that a reverse shell is still running on their machine. The restoration of a functioning desktop is not evidence of safety. It is, in practical terms, the moment the attacker no longer needs to pressure you — because they already have everything.

---

Apple's Mitigation and Its Limits

macOS 26.4, shipped in late March, introduced a warning when Terminal detects suspicious paste activity and a hard block for recognized malware. Microsoft cited this as a direct response to ClickFix-style delivery. ClickLock launched in May, a month after the warning went live.

The mitigation has documented gaps. The warning only fires for users who do not regularly use Terminal, and it includes a "Paste Anyway" button. The hard block requires macOS to already recognize the specific malware. Two campaigns exploited this space within weeks of each other in opposite directions. Jamf Threat Labs documented one in April that bypasses the paste check entirely by using an applescript:// URL to open Script Editor with the payload preloaded. Jamf researcher Thijs Xhaflaire wrote that "when one door closes, attackers find another." ClickLock kept the paste and engineered around the person instead.

Group-IB's analysts note the malware appears to still be under active development based on its code structure. The lure pages, the domains serving them, and whatever drives traffic to them remain entirely unconfirmed. The firm has the full payload chain with no front door.

What to Do If Your Mac Is Already Showing These Symptoms

If a Mac begins killing its own apps and presents a single password prompt on a frozen desktop, do not type the password. Group-IB advises holding the power button until the machine shuts down, then restarting in Safe Mode. On Apple silicon, that means holding the power button until "Loading startup options" appears, selecting the volume, holding Shift, and clicking Continue in Safe Mode.

Anyone who has already run this malware should revoke all active browser sessions and treat every saved password, cookie, and wallet key as compromised. For users uncertain about whether their system is clean, reviewing the best free malware removal tools available for your platform is a practical next step before restoring any credentials.

For additional context on the broader threat, Group-IB's public threat intelligence reporting is available at group-ib.com.

Immediate Actions for Mac Users

• Audit your Mac for LaunchAgents in ~/Library/LaunchAgents/ with names like com.authirity.plist or com.chromer.plist and remove them immediately if found
• Enable Full Disk Access restrictions and review which applications currently hold that permission in System Settings
• Replace saved browser passwords and crypto wallet keys with freshly generated credentials stored in a hardware-backed password manager rather than browser-native storage