ClickLock macOS Stealer Coerces Passwords Through App-Killing Pressure Loop
ClickLock exploits user psychology by creating an unbearable denial-of-service loop — killing critical applications every 210 milliseconds — until victims surrender their macOS login password to a fake system dialog. The root failure is a combination of insufficient user awareness about social engineering tactics and permissive macOS configuration that allows terminal-installed LaunchAgents to persist and execute with minimal friction. Once the password is obtained, the malware exfiltrates extraordinarily sensitive data including Keychain credentials, browser passwords, crypto wallets, and Chrome's Safe Storage key, effectively compromising the entire credential ecosystem. This attack illustrates how coercive UX manipulation can bypass even security-conscious users who would otherwise reject phishing attempts, making education about pressure-based social engineering critical.
Tactical Insight
Immediate actions
- Educate all macOS users to never enter their system password in response to unexpected dialogs or application behavior, and to force-restart instead.
- Audit and remove unauthorized LaunchAgents and LaunchDaemons from `~/Library/LaunchAgents` using tools like KnockKnock or BlockBlock.
- Enable macOS System Integrity Protection (SIP) and Gatekeeper to block unsigned or unnotarized binaries from executing.
Detection measures
- Deploy an endpoint detection and response (EDR) tool capable of flagging rapid, repeated process termination events (e.g., kills occurring at sub-second intervals).
- Monitor for unexpected terminal command execution and new LaunchAgent plist files created outside of sanctioned software installers.
- Alert on anomalous Keychain access requests or bulk credential reads from non-approved applications.
Long-term improvements
- Enforce least-privilege principles by restricting which users can install LaunchAgents or run arbitrary terminal commands via MDM policy.
- Implement a password manager with phishing-resistant autofill so credentials are never manually typed into unverified prompts.
- Conduct regular social engineering awareness training with simulations that include pressure-based and coercive UI scenarios specific to macOS environments.