In brief: ClickLock kills macOS applications in a continuous loop until users enter their password — a new extortion mechanism via LaunchAgents that requires systemic controls on macOS.
New macOS malware called ClickLock forces credential disclosure by terminating system applications in a continuous loop once users reject a fake password prompt. Infection occurs through terminal commands; installation of hidden LaunchAgents ensures the attack is re-activated with every system restart.
ClickLock is a macOS infostealer spread via a command inserted into Terminal. The malware initially presents users with a fake system dialog requesting a password. If the user declines or cancels the dialog, ClickLock installs two LaunchAgents in the system and terminates itself.
On the next system startup, critical applications — Finder, Dock, Spotlight, Terminal, and Activity Monitor — are repeatedly terminated by the LaunchAgents, approximately every 210 milliseconds. This process continues until the user enters their login password into the (also fake) prompt. This effectively forces victims to disclose their credentials, as normal system operation becomes impossible.
For CISOs, this attack model is relevant because it demonstrates a new category of pressure tactics against end users: rather than relying on classical phishing or social engineering, immediate coercion is exerted through systemic disruption. macOS systems, particularly in enterprise environments, therefore require enhanced endpoint detection and controls against the installation of unauthorized LaunchAgents.
Distribution via terminal commands indicates high social engineering effort but requires no exploitation of zero-days. Strict control over admin rights and user education regarding suspicious terminal commands are initial defensive measures.
Source: thehackernews.com · Published 16 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification via Lumi News Pipeline v1.7.3.