macOS ClickLock Malware Traps Users for Login Password

A novel information-stealing malware targeting macOS, named ClickLock, has been identified. This malware operates by terminating all visible processes on a user's screen. This action effectively creates a situation where the user is unable to interact with their system normally, leading them to believe a system update or critical process requires their attention.

Following the termination of visible processes, ClickLock presents a fake authentication prompt. This prompt is designed to mimic legitimate macOS login windows, thereby tricking the user into entering their system login password. Once the user inputs their password, the malware captures it. This captured password is then exfiltrated by the malware, likely for malicious purposes such as unauthorized access to the user's account or other sensitive data.

The discovery of ClickLock was reported by cybersecurity researchers who observed its behavior. The malware is distributed through various social engineering tactics, often disguised as legitimate software or updates. Users are advised to exercise caution when downloading and installing applications from untrusted sources and to be vigilant about unexpected system prompts requiring password entry. The specific distribution vectors and the full capabilities of ClickLock are still under investigation by security firms.