As reported by The Hacker News, a newly identified macOS infostealer dubbed ClickLock is turning the victim's own patience into a vulnerability — relentlessly killing foreground applications every 210 milliseconds until the user capitulates and enters their login password into a spoofed system dialog.
Why This Attack Is Different
Most credential stealers rely on deception — phishing pages, fake installers, or social engineering that tricks a user into wanting to enter their credentials. ClickLock takes a fundamentally different and more alarming approach: coercion through frustration. By making normal computer use literally impossible — killing Finder, Dock, Spotlight, Terminal, and Activity Monitor in a rapid loop — it doesn't fool the victim, it breaks them down.
This matters because it sidesteps many of the behavioral and psychological defenses security awareness training is built around. Users are taught to scrutinize unexpected prompts. They are rarely prepared for a scenario where their machine becomes functionally unusable until they comply. The 210ms kill interval is precise enough to prevent any meaningful interaction with the system, creating a "digital hostage" situation that mimics a system crash or malfunction.
Shield53 Perspective: ClickLock doesn't need to be sophisticated to be effective. It weaponizes urgency and helplessness — two states in which users make poor security decisions. This is a social engineering attack disguised as a technical one.
The Persistence Mechanism Deserves Attention
Even when a victim cancels the initial prompt, ClickLock is far from done. The malware installs two LaunchAgents and quietly exits — ensuring it reactivates at the next login without raising immediate alarms. This two-stage design is tactically clever: the noisy coercion phase gets the password, while the silent persistence phase ensures long-term access and exfiltration capability.
LaunchAgent abuse is not new on macOS, but its combination here with an aggressive foreground coercion loop represents a meaningful step forward in macOS-targeted threat sophistication. Security teams that monitor only for known malware signatures will likely miss the persistence installation entirely, especially since the malware exits cleanly after the initial interaction.
Who Is at Risk
The Broader Implication: Coercion as a Malware Category
ClickLock hints at an emerging threat philosophy: rather than hiding from the user, some next-generation stealers are choosing to confront them directly. We've seen ransomware use psychological pressure for years. Now infostealer authors are borrowing from that playbook. Expect this technique — system disruption loops designed to extract credentials rather than ransom — to proliferate and be adapted for Windows and Linux environments as threat actors validate its effectiveness.
The delivery vector (a command pasted into Terminal) also reinforces a trend Shield53 has been tracking: the abuse of legitimate system interfaces as malware delivery channels. This bypasses many traditional email and web gateway controls entirely.
Shield53 Recommendations
Immediate Actions
- Audit LaunchAgents and LaunchDaemons across your macOS fleet immediately. Look for recently created or modified entries in
~/Library/LaunchAgents/and/Library/LaunchAgents/that reference unfamiliar binaries or scripts. - Deploy or tune macOS EDR to alert on rapid, repeated process termination events — the 210ms kill loop is an anomalous behavioral signal that behavioral engines should be able to surface.
- Block or monitor Terminal access on non-developer endpoints using MDM policies (e.g., Jamf, Mosyle). Consider application allowlisting for high-risk user segments.
- User awareness training update: Specifically brief your teams on the tactic of system disruption as coercion. Users should know that if their Mac becomes suddenly unusable and a password prompt appears, the correct action is a hard shutdown — not compliance.
- Enforce least privilege: Ensure standard users do not have admin rights. An admin password prompt is far more dangerous when the account in question has elevated privileges.
- Review clipboard and Terminal history policies — if users are pasting attacker-supplied commands, detection at that layer (clipboard monitoring, shell history logging) can provide early warning.
Detection Guidance
- Alert on creation of new LaunchAgent plist files outside of software update windows
- Monitor for rapid, repeated
killor process termination signals targeting macOS system processes (Finder, Dock, Spotlight) - Flag synthetic password dialog creation from non-Apple-signed binaries using tools like Objective-See's BlockBlock or KnockKnock
ClickLock is a reminder that macOS is no longer a low-priority target. Threat actors are investing in platform-specific techniques that exploit both macOS architecture and user psychology. Defenders need to match that investment with equivalent vigilance.
