Executive Summary
On 9 June 2026, Group-IB Threat Intelligence reported a malicious shell script uploaded to VirusTotal assessed as a new modular macOS stealer likely distributed via ClickFix phishing pages, relying on compromised WordPress domains and Telegram infrastructure, with a strong European victim focus.
According to Group-IB, a ClickLock Stealer operation has already targeted at least 100 victims across 33 countries, with more than 50% from Europe, and has been active for approximately two months since May 2026.
Notably, the malware does not require elevated privileges or exploits for successful execution.
Key Takeaways
- ClickLock Stealer targets data from 8 browsers, 31 crypto wallet browser extensions, 7 password manager extensions, 8 desktop wallet applications, extracts blockchain addresses across 6 chains, macOS Keychain, shell history, and FTP credentials.
- Upon execution of a ClickFix command, the malicious script shows a terminal-based loading animation mimicking a Cloudflare progress bar with browser verification flow, while the malware orchestrates modules that search the system for browser credentials, password manager data, crypto wallet extensions, desktop wallet files, and employs a GSocket backdoor.
- The victim is forced to follow the attack flow and enter a password, because otherwise the malware “locks” the system by killing all visible processes except the Terminal, giving the malware its name, ClickLock Stealer.
- After modules complete their objectives, they forge timestamps, remove their persistence mechanisms, and self-delete, with the exception of the GSocket backdoor, which remains permanently installed. The attacker ends up with the macOS login password, Chrome’s encryption key, a full archive of stolen data, and a persistent backdoor.
- Based on the code structure and other observed artifacts, the malware is assessed to still be under development.
MITRE ATT&CK TTPs
- Initial Access (T1204.004 – Malicious Copy and Paste): The kill chain starts once the user pastes the command into Terminal. The orchestrator script (script[.]sh) disables keyboard interrupts, shows a fake Cloudflare animation, and downloads four components: a credential stealer (zsh[.]txt), a Keychain stealer (chrome[.]txt), a crypto-focused stealer (finderv2.jpg) from compromised WordPress infrastructure, and a GSocket-based backdoor installer (goyim).
- Credential Theft (T1056.002 – GUI Input Capture): A fake macOS password dialog is built with osascript. If the user complies, the password is validated and sent to Telegram immediately.
- Persistence (T1543.001 – Launch Agent): Both plist[.]css and chrome[.]js create LaunchAgent .plist files in ~/Library/LaunchAgents/. Any plist with RunAtLoad set to true automatically executes on user login, meaning even if the user reboots, the modules activate on the next login.
- Keychain Extraction (T1555.001): The extracted key is the AES encryption key used by Chromium-based browsers to encrypt locally stored cookies, passwords, and autofill data. Possession of this key allows offline decryption of Chrome Login Data and Cookies SQLite databases.
- Backdoor Installation (T1543.001): On macOS, the GSocket binary is disguised as iCloud within ~/Library/Application Support/iCloudsync, with the process masquerading as SystemUIServerl. The script leverages GSocket’s built-in persistence via crontab injection, shell RC file infection, and LaunchAgent creation.
- Exfiltration (T1567.002): The stolen key file and system profile are exfiltrated to an attacker-controlled Telegram bot via the sendDocument API method. Telegram serves as a lightweight C2 channel requiring no attacker-controlled infrastructure while providing encrypted transport unlikely to be blocked by network filters.
Indicators of Compromise (IOCs)
File Hashes (SHA1)
Network Indicators (Obfuscated)
- panalobet[.]ph – hosts chromer.txt, zsh.txt, finderv2.jpg, deng.php
- store.grafsynergy[.]com – hosts goyim backdoor installer
- cottonbox[.]co[.]il – hosts additional payload (hbd)
File System Artifacts
- ~/Library/LaunchAgents/com[.]authirity[.]plist
- ~/Library/LaunchAgents/com[.]chromer[.]plist
- $HOME/[.]cacheb/ (hidden staging directory)
Mitigation Options
- Monitor for osascript processes spawning password dialogs with custom icons, particularly when the icon is sourced from /tmp/ or other unusual locations.
- Alert on rapid, repeated pkill or killall activity targeting system processes (Finder, Dock, SystemUIServer, NotificationCenter) at sub-second intervals, as this behavior is unique to forced-interaction malware.
- Detect bulk access to browser profile directories followed by outbound connections to api[.]telegram[.]org or archive creation. Consider blocking or alerting on curl piped directly to bash, especially when source URLs use misleading file extensions (.jpg, .txt, .css).
- Deploy endpoint detection tools capable of behavioral analysis rather than relying solely on signature-based detection. This sample had zero VirusTotal detections at discovery, meaning static analysis tools provided no protection.
- Implement TCC (Transparency, Consent, and Control) monitoring to detect unexpected Full Disk Access grants, particularly to Terminal[.]app or shell interpreters.
![https://blog-admin.siriusxm.com/wp-content/uploads/2026/10/JeffLewisLiv…](https://blog-admin.siriusxm.com/wp-content/uploads/2026/10/JeffLewisLive-SiriusXM.png?w=940"){kind=link}
![https://blog-admin.siriusxm.com/wp-content/uploads/2024/08/siriusxm-col…](https://blog-admin.siriusxm.com/wp-content/uploads/2024/08/siriusxm-college-football-ncaa.jpeg?w=940"){kind=link}
![https://blog-admin.siriusxm.com/wp-content/uploads/2026/10/MLB-Postseas…](https://blog-admin.siriusxm.com/wp-content/uploads/2026/10/MLB-Postseason-Guardians-Rays-2026.jpg?w=940"){kind=link}
![https://blog-admin.siriusxm.com/wp-content/uploads/2026/03/siriusxm-nas…](https://blog-admin.siriusxm.com/wp-content/uploads/2026/03/siriusxm-nascar-radio-cup-series-16x9-1.jpeg?w=940"){kind=link}
![https://blog-admin.siriusxm.com/wp-content/uploads/2024/06/siriusxm-sun…](https://blog-admin.siriusxm.com/wp-content/uploads/2024/06/siriusxm-sunday-night-football-16x9-1.jpg?w=940"){kind=link}
![https://blog-admin.siriusxm.com/wp-content/uploads/2026/09/NFL-SiriusXM…](https://blog-admin.siriusxm.com/wp-content/uploads/2026/09/NFL-SiriusXM-2026.jpeg?w=940"){kind=link}