New macOS Malware ClickLock Stealer Targets Users with Social Engineering
A new macOS malware, named ClickLock Stealer, has been identified by cybersecurity firm Group-IB. This malware employs social engineering tactics and a coercion routine that renders a victim's machine unusable until their password is provided. The malware has affected at least 100 victims across 33 countries, with a significant concentration in Europe. The attack begins when a victim pastes a command into their Terminal, often lured by a ClickFix page. The malware downloads four components from compromised WordPress sites, focusing on credential theft and cryptocurrency asset searches. If the victim provides their password, it is exfiltrated along with a system fingerprint. If they cancel, the malware installs LaunchAgents to ensure the credential modules relaunch on login. A kill loop then terminates essential applications for up to 83 hours, while also suppressing Gatekeeper warnings. Exfiltration occurs via Telegram, leaving behind only the GSocket backdoor. 
