macOS ClickLock: Password Prompts Trap Users

A novel infostealer, dubbed ClickLock, is targeting macOS users through relentless social engineering tactics. Since May 2026, this threat has been active, primarily affecting users in Europe and spreading across 33 countries. ClickLock operates by continuously displaying password prompts and disabling essential applications like Finder and Dock every 210 milliseconds, rendering the device unusable until credentials are provided.

Once access is gained, ClickLock exfiltrates a wide range of sensitive data. This includes information from popular browsers, cryptocurrency wallets and extensions, password manager entries, FTP configurations, and general device details. The collected data is then compiled into a ZIP archive and transmitted via a Telegram Bot API. Notably, early variants of this malware evaded detection by security vendors for a period after its emergence.