Mac Malware Steals Passwords Via Fake Cloudflare Check

A sophisticated Mac malware known as ClickLock is distributing itself by tricking users into executing commands via the Terminal application, disguised as a routine human verification process. This malicious software is designed to steal sensitive information such as saved passwords, browser data, and cryptocurrency wallet files from infected systems.

Once initiated, ClickLock can disable system functions and repeatedly prompt for the user's login password, making the Mac nearly unusable until a valid password is provided, which is then exfiltrated to attackers. A critical component of this malware installs a hidden backdoor, enabling attackers to maintain remote access to the compromised Mac even after other malicious elements have been removed.

Researchers discovered the ClickLock script on VirusTotal, noting its initial lack of detection by security tools. The campaign has reportedly affected at least 100 systems across 33 countries since May 2026. A key indicator of this attack is any website asking users to open Terminal and paste commands for verification, a process legitimate services should not require.

To protect against ClickLock, users are advised to close suspicious websites directing them to Terminal, understand any command before running it, and be wary of unexpected password prompts. Keeping macOS updated, using strong antivirus software, and immediately shutting down an unresponsive Mac are crucial steps. If a Mac becomes unusable due to constant password requests, forcing a shutdown and booting into Safe Mode is recommended, followed by seeking professional cybersecurity assistance to remove the persistent backdoor.