A newly identified macOS malware dubbed ClickLock Stealer is leveraging fake Cloudflare verification prompts and ClickFix-style social engineering to compromise users without requiring exploits or elevated privileges, according to Group-IB researchers.
The malware, discovered in June 2026 with zero detections on VirusTotal, highlights a growing shift in macOS threats toward deception-driven attacks.
While macOS malware remains less common than Windows threats, families such as Atomic Stealer (AMOS), Banshee, and Poseidon have demonstrated increasing attacker interest in Apple systems particularly targeting cryptocurrency users and high-value credentials.
ClickLock Stealer Cloudflare Trap
ClickLock Stealer is believed to be distributed via phishing pages that mimic legitimate services, such as Cloudflare CAPTCHA checks.
Victims are instructed to copy and paste a command into the macOS Terminal as part of a supposed “verification” step.
Once executed, the script displays a convincing terminal-based animation imitating Cloudflare checks, including messages such as “Verifying you are not a bot.”
This visual deception masks malicious activity occurring in the background. The attack does not rely on vulnerabilities. Instead, it exploits user trust.
The script turns off user interrupts, suppresses system notifications, and begins downloading multiple payloads from compromised WordPress sites while maintaining the illusion of legitimacy.
A key innovation is its “locker” technique. If a user refuses to enter their password, the malware repeatedly kills system processes including Finder, browsers, and Activity Monitor effectively locking the system until credentials are provided; this forces interaction without exploiting system vulnerabilities.
Collected data is compressed and exfiltrated via Telegram bots, eliminating the need for dedicated command-and-control infrastructure.
Meanwhile, the GSocket-based backdoor ensures long-term access by disguising itself as legitimate system processes.
To evade detection, most components self-delete after execution and manipulate timestamps to hinder forensic analysis. Additionally, a background loop disables macOS NotificationCenter for hours, suppressing security alerts.
The infection chain is particularly effective because it combines multiple fallback mechanisms.
If a user initially refuses, persistence via LaunchAgents ensures the attack resumes on the next login. If credentials are entered early, the compromise completes ઝડપ სწრაფly and silently, Group-IB said.
Security researchers emphasize that behavioral indicators are critical for detection.
Suspicious activity may include repeated process termination, unauthorized Keychain access attempts, osascript-triggered password prompts, and unusual outbound connections to Telegram APIs.
Indicators of Compromise
| Type | Indicator | Description |
|---|---|---|
| Domain | panalobet[.]ph | Compromised WordPress host used for payloads |
| URL | hxxps://panalobet[.]ph/wp-content/themes/twentytwenty/assets/fonts/chromer.txt | Keychain stealer module (chromer.txt) |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
