A new malware targeting macOS systems has been identified, known as ClickLock Stealer.
The malicious installer locks a Mac in a persistent window that demands the user’s login password before proceeding with installation.
Once the password is entered, the malware installs covertly, capturing sensitive information such as browser credentials, cryptocurrency wallet data, and password manager entries.
Attackers lure victims with a counterfeit Cloudflare CAPTCHA, prompting them to copy a command into the macOS Terminal and initiate the installation process.
If a user attempts to cancel the installation, the malware repeatedly terminates visible applications every 210 milliseconds, leaving only the password prompt on screen and forcing compliance.
The campaign appears focused on high-income regions where cryptocurrency usage and macOS adoption are prevalent, with the largest numbers of affected users reported in Italy, the United States, Jordan, and the United Kingdom.
Users should refrain from downloading software from unfamiliar sites and avoid opening links in unsolicited emails or text messages.
When encountering a suspicious link, it is advisable to verify the sender’s address and inspect the URL by copying it into a text editor for closer examination.
Software should be obtained through official channels such as the Apple App Store or directly from reputable developers’ websites.
Using cracked or pirated software exposes systems to significant malware risks and should be avoided.
Apple’s App Store vetting process provides an additional layer of security, helping to ensure that applications meet certain safety standards.
Maintaining vigilance against deceptive tactics and sourcing software from trusted providers are key steps in protecting macOS devices from emerging threats.
