Active ClickLock Stealer Campaign Targets macOS Users via ClickFix Social Engineering
July 30th, 2026
High
Our Cyber Threat Intelligence Unit has identified ClickLock as an active macOS information-stealing malware campaign that relies on social engineering rather than software exploitation to compromise systems. First observed in May 2026 and publicly documented by security researchers in July 2026, the campaign uses deceptive ClickFix prompts and fake Cloudflare verification pages to persuade users to execute malicious Terminal commands and disclose their macOS login credentials. Once executed, the malware silently retrieves credential-stealing components, suppresses user notifications, and employs persistence techniques to hinder detection while harvesting sensitive information. The campaign has affected at least 100 victims across 33 countries, with more than half located in Europe, demonstrating that user-driven attack techniques continue to present a significant risk to organizations despite modern endpoint security controls. Organizations should remain vigilant against deceptive verification prompts and reinforce user awareness to reduce the likelihood of compromise.
Technical Details
Threat Type: Information-stealing malware delivered via social engineering (ClickFix)
Severity: High
No CVE or vendor CVSS rating applies, as this is a social-engineering-driven malware campaign. The rating reflects confirmed active exploitation, full credential and Keychain compromise, and installation of a persistent remote-access backdoor across at least 100 victims in 33 countries.
Affected Platform: macOS (all versions; no version-specific dependency)
Attack Chain / Method:
Initial Access: The victim is directed to a spoofed Cloudflare “verify you are human” page and instructed to paste and run a Terminal command; the technique requires no exploit or elevated privileges.
Loader: The executed command runs the orchestrator script, script.sh, which disables Ctrl+C, hides the cursor, and displays a fake verification progress bar while downloading four modules in the background.
Modules: zsh.txt (credential stealer), chromer.txt (Chrome Safe Storage and Keychain stealer), finderv2.jpg (cryptocurrency and browser data stealer), and goyim (GSocket-based backdoor installer).
Staging: zsh.txt and chromer.txt are saved to the hidden directory $HOME/.cacheb/; finderv2.jpg and goyim are piped directly into bash without touching disk.
Credential Theft: A fake macOS password prompt built with osascript captures the login password, which is validated locally with dscl /Local/Default -authonly before exfiltration.
Defense Evasion: NotificationCenter is suppressed for approximately six hours. If the user cancels the password prompt, persistence is installed via the LaunchAgents com.authirity.plist and com.chromer.plist to retry at next login.
Coercion: On relaunch, the stealer modules repeatedly kill Finder, Dock, SystemUIServer, Terminal, Activity Monitor, Console, Spotlight, NotificationCenter, and major browsers until the user enters a password or approves Keychain access.
Data Targeted: macOS Keychain, the Chrome Safe Storage AES key, browser credentials, cookies and session tokens, password manager data,cryptocurrency wallets, and shell history.
Exfiltration: Stolen data and system fingerprinting information, including username,macOS version, CPU, RAM, disk size, and public IP, are sent via the Telegram Bot API.
Persistence: The goyim GSocket backdoor establishes long-term remote access through LaunchAgents, crontab, and shell profile modification such as .zshrc; its installation path is disguised as an iCloud sync folder, and the running process masquerades as SystemUIServer.
Anti-Forensics: The stealer modules self-delete and forge file timestamps after execution; the GSocket backdoor does not self-delete and remains resident.
Impact
Organizational Risk: macOS endpoint users, particularly executives, developers, IT administrators, finance staff, and anyone with access to sensitive corporate resources, face elevated risk given the campaign's reliance on user interaction rather than exploitation.
Credential and Data Compromise: Successful execution can expose macOS login credentials, Keychain secrets, the Chrome Safe Storage encryption key, browser-stored passwords, cookies, session tokens, password manager data, cryptocurrency wallets, and other sensitive files, allowing offline decryption of locally stored browser credentials.
Unauthorized Access: The GSocket backdoor and LaunchAgent, crontab, and shell-profile persistence allow attackers to maintain long-term remote access, conduct follow-on activity, and evade detection through self-deleting payloads and timestamp manipulation.
Operational and Business Impact: Compromised credentials and persistent access can facilitate account takeover, lateral movement, data exfiltration, and further malware deployment, driving business disruption, incident response costs, financial losses, and extended recovery timelines.
Compliance and Reputational Risk: Unauthorized access to corporate, customer, or financial data may trigger regulatory reporting obligations, legal exposure, and reputational damage, particularly for organizations subject to data protection regulations.
Detection Method
Monitor Terminal Activity: Alert on Terminal commands copied from browsers, particularly those invoking curl, bash, or osascript, and monitor for suspicious child processes such as script.sh, zsh.txt, chromer.txt, finderv2.jpg, and goyim.
Monitor Persistence Mechanisms: Alert on creation or modification of ~/Library/LaunchAgents/com.authirity.plist and com.chromer.plist, .zshrc changes, crontab modifications, and creation of the hidden $HOME/.cacheb/ directory.
Detect Credential Harvesting and Defense Evasion: Monitor for osascript generating repeated macOS authentication dialogs, rapid repeated termination of Finder, Terminal, Activity Monitor, Dock, SystemUIServer, or NotificationCenter processes, and prolonged NotificationCenter suppression.
Monitor Sensitive Data Access: Alert on abnormal access to macOS Keychain, Chrome Safe Storage, browser profile directories, password manager data, cryptocurrency wallet directories, and shell history from Terminal or unsigned processes.
Monitor Network Indicators: Investigate outbound connections to the Telegram Bot API (api.telegram.org), ifconfig.me, and the GSocket relay infrastructure (gsnc[.]eu), particularly when preceded by Terminal activity or credential prompts.
Indicators of Compromise
Type | Indicator | Description |
SHA-1 | d9617710d4ed8e9b87f6fee0b7014c4101effba0 | script[.]sh — orchestrator |
SHA-1 | b67aa4f598c0ea625a7409ea7884e10a7bc9c3ff | chromer[.]txt — Keychain stealer |
SHA-1 | 8dda05168ea8610a2449419a47517bc32823d6ec | zsh[.]txt — credential stealer |
SHA-1 | 0a1fb016bd10bac5455175c79aa4511e5ff1a330 | finderv2[.]jpg — cryptocurrency and browser data stealer |
SHA-1 | 2fc970e25570532f9cbe33b7ebfe1f0383a7341a | goyim — GSocket backdoor installer |
URL | hxxps://panalobet[.]ph/wp-content/themes/twentytwenty/assets/fonts/chromer.txt | chromer[.]txt hosting location |
URL | hxxps://panalobet[.]ph/wp-content/upgrade/zsh.txt | zsh[.]txt hosting location |
URL | hxxps://panalobet[.]ph/wp-content/themes/twentytwenty/assets/images/finderv2.jpg | finderv2[.]jpg hosting location |
URL | hxxps://panalobet[.]ph/wp-content/deng.php | goyim system-fingerprint exfiltration endpoint |
URL | hxxps://store.grafsynergy[.]com/media/goyim | goyim hosting location |
URL | hxxps://cottonbox[.]co[.]il/wp-content/hbd | Additional compromised infrastructure |
Domain | gsnc[.]eu | GSocket backdoor relay infrastructure used for persistent remote access |
Recommendations
Apply the latest macOS security updates and ensure endpoint security solutions, browsers, and security tools run current versions with up-to-date threat intelligence.
Prohibit users from executing Terminal commands obtained from untrusted websites or unsolicited verification prompts; implement application control or allowlisting to restrict unauthorized script execution where feasible.
Enable Multi-Factor Authentication (MFA) for all enterprise applications and cloud services, enforce strong password policies, and monitor privileged accounts for suspicious authentication activity.
Monitor EDR, macOS Unified Logs, and network telemetry for osascript execution, creation of the named LaunchAgents, creation of the hidden $HOME/.cacheb/ directory, rapid repeated process termination, and outbound connections to the Telegram Bot API, ifconfig.me, and GSocket infrastructure.
Immediately isolate affected endpoints, perform a full forensic and malware scan, remove unauthorized persistence mechanisms, reset compromised credentials, and review cloud and enterprise accounts for unauthorized access.
Maintain offline or immutable backups, regularly verify restoration procedures, and confirm recovery images are free of persistence mechanisms before returning systems to production.
Train users to recognize ClickFix-style social engineering, fake Cloudflare verification pages, and the risks of copying and executing Terminal commands from untrusted sources.
Deploy endpoint detection tools capable of behavioral analysis rather than relying solely on signature-based detection, given this sample evaded static detection at the time of discovery.
Conclusion
The ClickLock campaign demonstrates that macOS systems can be compromised through social engineering alone, without exploiting any software vulnerability, resulting in credential theft, persistent remote access, and potential compromise of enterprise resources. The attack chain hinges entirely on a user pasting and executing a Terminal command in response to a spoofed verification prompt. Layered coercion and persistence mechanisms ensure the attack proceeds even if a user initially declines. We urge organizations to restrict unnecessary Terminal access, deploy behavioral detection capable of catching this un-signatured threat, and reinforce user awareness of paste-based social engineering. Prompt implementation of the recommendations above, coordinated across security, IT, and incident response teams, will materially reduce exposure to this and similar campaigns.