ClickLock Mac malware locks apps until you give in - Fox News

What the report says

Fox News reported on a newly described Mac malware attack called ClickLock that uses a fake “verify you are human” flow to push users into running a Terminal command. According to the report, the page presents what appears to be a verification process, but the pasted command downloads malicious components in the background and may later display a password prompt designed to resemble a macOS request.

The article cites cybersecurity company Group-IB, which found the malicious script on VirusTotal. Fox News reported that it was first uploaded there on June 9, 2026, and that Group-IB said the campaign had affected at least 100 systems in 33 countries since May. Researchers believe the attack likely uses a ClickFix-style lure, in which a fake error or verification message persuades the user to run a command rather than relying on a software vulnerability.

Once active, ClickLock is described as seeking Mac login credentials, browser data, password manager extension information, macOS Keychain data and cryptocurrency wallet files. If a user refuses or cancels the fake password request, the malware can return after login and repeatedly close apps such as Finder, browsers, Terminal, Activity Monitor and System Settings, making the computer difficult to use. Fox News also reported that one component can trigger a genuine Keychain authorization prompt while attempting to access Chrome-related secure storage.

The report said ClickLock can package stolen data for upload through Telegram’s Bot API and may install a persistent backdoor using a modified open-source GSocket tool, disguised as an iCloud-related process. The incident matters because it highlights a social-engineering technique aimed at Mac users: legitimate verification pages should not ask people to paste commands into Terminal.