100 Systems in 33 Nations Hit by Mac Malware That Locks Apps, Steals Passwords

For cybersecurity professionals, ClickLock represents a dangerous evolution in Mac-targeted threats. By combining social engineering with a seemingly legitimate macOS user interface element, it co-opts the user into compromising their own system, making endpoint protection and user training critical.

A new Mac malware campaign discovered by Group-IB researchers employs a uniquely coercive social engineering technique to compromise macOS systems. Dubbed ClickLock, the malware lures users through a fake “verify you are human” webpage that instructs them to copy and paste a command into Terminal. Once executed, a convincing progress bar appears while the script silently downloads and installs malicious software. The attack then presents what looks like a legitimate macOS password dialog; if the user cancels, the malware will repeatedly quit Finder, browsers, and other applications, rendering the Mac nearly unusable until the login password is entered. This extortion-like behavior—locking apps until the user surrenders credentials—is a hallmark of ClickLock.

“

For cybersecurity professionals, ClickLock represents a dangerous evolution in Mac-targeted threats.

The malware’s objectives go beyond credential harvesting. Once installed, ClickLock searches for saved passwords, browser data, and cryptocurrency wallet files, and deploys a hidden backdoor that allows attackers to remotely reconnect and control the infected machine. According to Group-IB, the threat has been active since at least May 2026 and has already hit over 100 systems across 33 countries, suggesting a broad and deliberate targeting campaign. The malicious script was first uploaded to VirusTotal on June 9, 2026, yet at the time of analysis, none of the platform’s integrated security engines flagged it as malicious—highlighting its ability to evade signature-based detection.

ClickLock follows a growing trend of malware that exploits user trust in system interfaces rather than relying on purely technical exploits. In this case, the attack chain mimics a legitimate CAPTCHA verification, a familiar web element, and then abuses the Terminal, a powerful command-line tool that average users rarely interact with. By instructing the victim to run a command, the attacker effectively bypasses macOS Gatekeeper and code-signing checks, as the command executes directly within the user’s session. The use of an app-locking mechanism to apply pressure is a psychological twist: many users, frustrated and unable to work, will comply and enter their password, unwittingly handing over the keys to their digital lives. This technique is reminiscent of previous “scareware” or “ransomware” tactics but applied in a more subtle, non-encrypting manner to steal credentials and install persistence.

The implications for both consumers and enterprises are significant. For individuals, ClickLock poses a direct threat to personal data, including online banking credentials, email accounts, and cryptocurrency holdings. The theft of crypto wallet files is particularly troubling, as hot wallets store private keys and can lead to immediate and irreversible financial loss. For organizations, any infected Mac could act as a beachhead for lateral movement, corporate espionage, or ransomware deployment, especially given the backdoor’s remote-control capabilities. With macOS’s growing market share in enterprise environments (partly driven by employee choice programs), the attack surface for such threats is expanding. Moreover, the campaign’s detection by a cybersecurity firm rather than by built-in defenses underscores the need for layered security, including endpoint detection and response (EDR) solutions and proactive threat intelligence.