New ClickLock macOS malware traps users into revealing login password

A new macOS malware named ClickLock targets users through social engineering to steal login credentials, cryptocurrency assets, browser data, and password manager information. The malware forces victims into entering their system password by displaying fake authentication dialogs and terminating critical system processes. It establishes persistence via LaunchAgents, exfiltrates data through Telegram, and deploys a persistent backdoor using GSocket for remote access. The malware leverages compromised legitimate domains and evades detection by self-deleting modules and clean reputations of host infrastructure.

AI-extracted · verify before operational use