Europe – October 19, 2026 -- A new macOS infostealer dubbed ClickLock Stealer has targeted at least 100 victims across 33 countries since May 2026, with more than 50% of them in Europe, according to Group-IB Threat Intelligence.
Group-IB reported on 9 June 2026 that a malicious shell script uploaded to VirusTotal was assessed as a new modular stealer, likely distributed through ClickFix phishing pages. The operation has been active for approximately two months and relies on compromised WordPress domains and Telegram infrastructure. The malware needs no elevated privileges or exploits to execute.
Sample showed zero VirusTotal detections at discovery
Group-IB states that static analysis tools provided no protection against the sample, which had zero VirusTotal detections when found. The firm recommends behavioral endpoint detection rather than reliance on signature-based tools. Based on code structure and other artifacts, the malware is assessed to still be under development.
Fake Cloudflare check forces victims to enter their password
Once a victim pastes the ClickFix command into Terminal, the orchestrator script disables keyboard interrupts and displays a terminal animation mimicking a Cloudflare progress bar and browser verification flow. It then downloads four components: a credential stealer (zsh.txt), a Keychain stealer (chrome.txt), a crypto-focused stealer (finderv2.jpg) hosted on compromised WordPress infrastructure, and a GSocket-based backdoor installer (goyim).
A fake macOS password dialog built with osascript captures the login password and sends it to Telegram immediately after validation. If the victim refuses, the malware locks the system by killing all visible processes except Terminal, which gives the stealer its name.
Stealer covers 8 browsers, 31 wallet extensions and 8 desktop wallets
The malware targets data from 8 browsers, 31 crypto wallet browser extensions, 7 password manager extensions and 8 desktop wallet applications. It also extracts blockchain addresses across 6 chains, macOS Keychain contents, shell history and FTP credentials.
The extracted Chrome key is the AES key Chromium-based browsers use to encrypt locally stored cookies, passwords and autofill data. With it, attackers can decrypt Chrome Login Data and Cookies SQLite databases offline. The key file and system profile are exfiltrated to an attacker-controlled Telegram bot via the sendDocument API method. Group-IB notes that Telegram acts as a lightweight command-and-control channel requiring no attacker-owned infrastructure, and its encrypted transport is unlikely to be blocked by network filters.
GSocket backdoor survives self-deletion of other modules
After completing their tasks, the modules forge timestamps, remove their persistence mechanisms and self-delete. The GSocket backdoor is the exception and stays permanently installed. On macOS it is disguised as iCloud in ~/Library/Application Support/iCloudsync, with the process masquerading as SystemUIServerl. Persistence runs through crontab injection, shell RC file infection and LaunchAgent creation. The attacker retains the macOS login password, Chrome's encryption key, an archive of stolen data and the backdoor.
Group-IB lists network indicators and detection measures
Network indicators include panalobet[.]ph, which hosts chromer.txt, zsh.txt, finderv2.jpg and deng.php; store.grafsynergy[.]com, which hosts the goyim installer; and cottonbox[.]co[.]il, which hosts an additional payload. File system artifacts include com[.]authirity[.]plist and com[.]chromer[.]plist in ~/Library/LaunchAgents/, plus the hidden staging directory $HOME/[.]cacheb/.
Group-IB advises monitoring osascript password dialogs with custom icons sourced from /tmp/, alerting on sub-second pkill or killall activity against Finder, Dock, SystemUIServer and NotificationCenter, and flagging curl piped directly to bash with misleading extensions such as .jpg, .txt or .css. It also recommends TCC monitoring for unexpected Full Disk Access grants to Terminal.app or shell interpreters.