A new malware scheme targets Mac users through a fake verification page designed to trick you into running malicious commands. This page instructs you to open Terminal and paste a command, quietly downloading malware onto your device.
How ClickLock Attacks
The malware, known as ClickLock, is crafted to steal sensitive information from your Mac. It searches for saved passwords, browser data, and cryptocurrency wallet information. Additionally, it can install a tool that allows attackers to reconnect and control your computer remotely.
Researcher Group-IB discovered this malicious script on VirusTotal on June 9, 2026. They reported that security tools initially failed to detect it. The campaign has targeted 100 systems in 33 countries since May.
How the Attack Works
The attack begins with a fake verification page, asking you to paste a command into Terminal. After doing so, the page shows a convincing progress bar while downloading the malware in the background. An authentic-seeming password request may follow, tricking users into entering their login credentials.
Error-filled pop-ups reappear upon any access denial, mimicking macOS requests and closing Finder, your browser, and other apps, making the device dysfunctional until you surrender your password.
Malware’s Capabilities
ClickLock is designed to gather extensive information, including:
- Saved usernames and passwords
- Cookies and session data
- Autofill details
- Bookmarks and storage
- Cryptocurrency wallet extensions
- Password manager data
The malware can even capture basic data about your Mac and its public IP address, uploading everything via Telegram.
Protect Yourself from ClickLock
To avoid falling victim to this attack, follow these steps:
- Close any sites instructing you to use Terminal commands for verification immediately.
- Understand any command before entering it. Seek advice from a trusted technician if unsure.
- Skeptically view unexpected password requests, as genuine prompts typically occur in other contexts.
- Stay updated with the latest macOS security patches.
- Use reputable antivirus solutions for additional layers of protection.
- If applications start closing unexpectedly, shut down your Mac without entering your password. Restart in Safe Mode for security checks.
- Secure critical accounts using a different device, changing passwords and looking for unauthorized sessions.
Your vigilance can prevent ClickLock from accessing your system. Stay aware and always scrutinize unusual requests from websites or software.