ClickLock Stealer Locks macOS Until Victims Enter Real Passwords and Exfiltrates Browser, Crypto and Keychain Data
Researchers at Group-IB have uncovered a previously unknown macOS infostealer that literally locks victims out of their computers until they supply valid login credentials. The newly identified threat, dubbed ClickLock Stealer, has been active since May 2026 and has already impacted at least 100 users in 33 countries.
The attack chain starts with a fake Cloudflare verification page. Unsuspecting users are instructed to copy and paste a command into the Terminal. While the victim watches a convincing browser-check animation with a progress bar, the script silently downloads four malicious modules hosted on compromised WordPress sites.
Once the modules are in place, a realistic macOS authentication dialog appears displaying the user’s real account name and requesting the password. ClickLock validates the entered password against the local directory service and transmits only working credentials to the operators. Pressing “Cancel” is ineffective: two LaunchAgent modules are installed that reactivate on every login.
One agent repeatedly closes every visible application every 210 milliseconds, leaving only the password-entry window on screen. The second agent forces the user to approve a genuine Keychain authorization prompt, allowing the malware to steal the encryption key for Chrome Safe Storage. A separate background process disables the Notification Center for several hours to prevent users from spotting suspicious activity.
The harvested data is extensive. ClickLock extracts credentials and cookies from eight browsers, 31 cryptocurrency-wallet browser extensions, seven password managers, eight desktop cryptocurrency wallets, the full Keychain database, Terminal command history, FTP account details and wallet addresses on six different blockchains. Stolen information is sent to the attackers through Telegram bots and compromised domains.
After completing its tasks, most modules delete themselves and tamper with file timestamps to hinder forensic analysis. A persistent, disguised GSocket backdoor remains on the system for potential future access. Investigators consider a connection to the ClickFix social-engineering technique highly likely, although the actual phishing pages used in this campaign have not yet been observed.
Related articles
Backblaze Responds in Minutes While reg.ru Delays Action on Banking Trojan Infrastructure
A detailed reverse-engineering report reveals a sophisticated Android banking Trojan distributed via Telegram spam that disables antivirus apps, intercepts SMS one-time codes, and exfiltrates banking credentials. The malware uses AES-encrypted assets, a custom binary protocol over sockets, and multiple modules for screen streaming, keylogging, microphone access, and remote control. Infrastructure analysis traced the payload to an S3-compatible bucket on Backblaze, four command-and-control domains, and a VPS, with the domains registered through reg.ru. Notifications sent to Backblaze resulted in account termination within 11 minutes, while reg.ru responded only after a week with a statement refusing action without a court order. The same signing certificate appears across multiple variants, allowing rapid infrastructure rotation that keeps the campaign active despite takedown attempts. Kaspersky and CERT teams were also notified but produced no visible results within the observed period.
SLEEPWALKER Backdoor Activates on Windows via Single Custom Encrypted Packet
SLEEPWALKER is a passive Windows backdoor that stays dormant in memory until it receives one specially crafted encrypted network packet. Upon activation the implant decrypts and executes custom bytecode written in a proprietary 23-instruction language, eliminating traditional beaconing and reducing network indicators. The malware is delivered as a 64-bit DLL that impersonates dpapi.dll and is loaded via DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous and NullSessionPipes. Configuration is protected with AES-256-CCM and the sample contains no confirmed victims or attributed infrastructure. Researchers have released YARA rules and read-only scanning utilities to detect the implant and its artifacts.
SLEEPWALKER Backdoor Stays Dormant Until Triggered by Single Custom Network Packet
SLEEPWALKER is a stealthy Windows backdoor that remains inactive until it receives one specially crafted encrypted network packet. The implant then decrypts and executes custom bytecode from a proprietary 23-instruction language, enabling chained tasks, data movement, and in-memory code execution without prior outbound communication. The 64-bit DLL masquerades as dpapi.dll and is designed for DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw network traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes, and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous. No confirmed victims or attribution have been identified, and the analysis is based on a single sample. Researchers recommend auditing endpoints for unexpected dpapi.dll files alongside ERAAgent.exe and reviewing related registry settings.
AmnesiaStealer Malware for macOS Hijacks Authenticated Browser Sessions via ClickFix and Chromium
A new macOS malware strain named AmnesiaStealer has emerged that combines infostealing, persistence mechanisms, and the ability to silently take over already authenticated browser sessions. The infection chain begins with a fake GitHub page that tricks victims into copying a malicious command into Terminal using the ClickFix social engineering technique. Once executed, the Rust-based payload collects system data, displays a fake installer window to capture the user password, and attempts to unlock the Keychain for protected credentials. Targeted data includes browser cookies, history, extensions, documents, Apple Notes, Telegram sessions, and cryptocurrency wallet information. A secondary module copies the browser profile and launches a hidden Chromium instance controlled through the Chrome DevTools Protocol, allowing attackers to interact with active sessions that have already passed multi-factor authentication. Persistence is achieved via a disguised LaunchDaemon, and the malware attempts to remove installation artifacts afterward.