Mac malware ClickLock uses fake Terminal prompts to steal passwords
ClickLock is a Mac malware campaign that tricks users with a fake verification page prompting Terminal input; once run, it stealthily downloads payloads to steal passwords, browser data, crypto wallets and other data, and installs a persistent backdoor via LaunchAgents. It can close apps to pressure password entry, with exfiltration via Telegram Bot API. Group-IB reports at least 100 infected systems in 33 countries since May. To stay safe: never paste commands from suspicious pages, boot in Safe Mode if compromised, keep macOS updated, use reputable antivirus, and secure accounts from another device.
