A new strain of macOS malware dubbed ClickLock Stealer has emerged, introducing a coercive psychological element to traditional credential theft. Unlike many silent stealers that prioritize stealth, ClickLock utilizes a disruptive mechanism to force victims into compliance when they initially refuse to provide their credentials. According to The Hacker News, this malware leverages a combination of social engineering and aggressive system interference to achieve its objectives.
Overview of the ClickLock Attack Chain
The infection begins with a sophisticated Phishing or social engineering lure that convinces a user to copy and paste a command into the macOS Terminal. This TTP is increasingly common, as it bypasses many traditional gateway defenses and relies on the user’s explicit authorization. Once executed, the script presents a fake system dialog box requesting the user’s login password.
If the user identifies the prompt as suspicious and clicks ‘Cancel’, the malware does not immediately activate its disruptive payload. Instead, it quietly establishes persistence by installing two malicious LaunchAgents and then exits. This delay is a calculated tactic designed to decouple the initial infection event from the eventual system failure, making it harder for the victim to associate the disruption with the recently executed command.
ClickLock Malware Persistence Analysis
Security teams looking to detect ClickLock macOS stealer infections must focus on the persistence layer. The malware installs LaunchAgents within the user’s Library directory (~/Library/LaunchAgents). These agents are configured to trigger upon the next user login, ensuring that the malware remains active even after a system restart.
Upon the subsequent login, the malware activates a high-frequency loop. It is programmed to identify and terminate several core macOS processes every 210 milliseconds. These processes include:
- Finder: Prevents file system navigation.
- The Dock: Removes the primary application launcher and switcher.
- Spotlight: Disables system-wide search capabilities.
- Terminal: Prevents the user from executing command-line remediation.
- Activity Monitor: Blocks the victim from identifying or killing the malicious process.
By killing these applications nearly five times per second, the malware renders the graphical user interface essentially unusable. The victim is then presented with the same fake password prompt. Given the state of the machine, victims are often coerced into entering their credentials simply to restore system functionality. Once the password is typed, the loop ceases, and the stolen data is likely exfiltrated to a remote C2 server.
Recommendations and macOS Infostealer Mitigation Strategies
To defend against ClickLock and similar threats, SOC teams should prioritize the following defensive measures:
- User Awareness Training: Educate employees on the extreme risks associated with running unverified scripts or commands in the Terminal, regardless of the source.
- Monitoring for New LaunchAgents: Use an EDR or SIEM to alert on any new property list (.plist) files being created in
~/Library/LaunchAgentsor/Library/LaunchAgents. This is a primary IoC for ClickLock. - Application Control: Implement strict application execution policies that prevent the launch of unknown binaries or scripts from temporary or user-writable directories.
- Privilege Management: Encourage the use of non-administrative accounts for daily tasks, which may limit the reach of certain Privilege Escalation attempts, though ClickLock primarily targets the user’s own password.
Defenders must recognize that as macOS adoption increases in the enterprise, the frequency and creativity of macOS-specific malware will continue to grow.