New macOS Malware ClickLock Targets Passwords and Cryptocurrency Assets

• July 19, 2026

Security researchers from Group-IB have identified a new piece of malicious software affecting macOS users, dubbed ClickLock. This malware is engineered to harvest sensitive user data, including passwords and cryptocurrency holdings, by coercing victims into divulging login credentials.

How ClickLock Operates

ClickLock employs a unique tactic to extract confidential information. Upon activation, the malware forcibly terminates all active system processes, effectively locking users out of their sessions. This disruption prompts a login screen that appears to be legitimate, compelling users to re-enter their passwords and, unwittingly, hand over critical access details to the attackers.

Once inside, the threat targets various sources of sensitive data. It focuses on compromising cryptocurrency wallets, extracting data from web browsers, and infiltrating password management applications. By doing so, ClickLock aims to maximize its theft of private credentials and digital assets.

Unlike many typical macOS threats, this malware’s approach of system-wide process termination to simulate a login prompt makes it particularly insidious. Users are tricked by a seemingly routine security measure, while ClickLock operates stealthily in the background to collect valuable information.

The discovery highlights growing concerns around the security of macOS environments, which have traditionally been perceived as more resistant to malware compared to other operating systems. However, ClickLock’s existence underscores that macOS users remain vulnerable to sophisticated cyberattacks targeting financial and personal data.

Detailed technical information about ClickLock’s distribution method and the extent of its impact has yet to be publicly disclosed. Security experts recommend vigilance when encountering sudden login prompts and advise users to verify the legitimacy of any unusual system behavior to mitigate the risk posed by such malware.

This revelation serves as a warning that attackers are increasingly focusing on macOS platforms with customized threats designed to exploit user trust and system privileges to steal valuable digital assets.

Security researchers have uncovered ClickLock, a macOS malware designed to steal passwords and cryptocurrency by forcing users to re-enter their credentials.