New Mac malware traps users with fake login window
ClickLock Stealer malware tricks users with a persistent password prompt.
1ClickLock Stealer's dangerous game
Discovered by Group-IB, the new ClickLock Stealer malware deceives Mac users with a fake Cloudflare CAPTCHA. Users are tricked into pasting a specific command in Terminal, which installs the malware. The software then locks the user's Mac with a fake login window.
2How it operates
Once installed, the malware locks the user's Mac and forces them to enter a password. After the password is entered, the malware starts running in the background. It terminates all visible applications every 210 milliseconds, coercing the user to comply.
3Targeted data
ClickLock Stealer captures sensitive information such as browser credentials, crypto wallet extensions, desktop wallet files, and password manager data. This information is then transferred to malicious actors for financial gain.
4Targeted countries
The malware primarily targets users in Italy, the U.S., Jordan, and the UK. Group-IB notes that this geographic distribution correlates with high-income regions where cryptocurrency adoption and macOS market share are significant.
5Protection methods
To avoid such threats, users should refrain from downloading software from unknown sources. Suspicious links in emails or messages should not be opened. Obtaining apps from the Mac App Store or the developer's official site is the safest approach.
6Additional security measures
Users can protect their systems by using security software. Following security guides from sources like Macworld and avoiding cracked software will provide additional protection against such threats.
Original article: Macworld — Yeni Mac zararlı yazılımı kullanıcıları tuzağa düşürüyor