# New Mac malware traps users with fake login window ClickLock Stealer malware tricks users with a persistent password prompt. - **Source:** [Macworld](https://brifing.si/source/5c5245ce-d063-40e0-bd54-48b60cbc761f) - **Published:** 2026-07-17 - **Original article:** - **On Brifing:** https://brifing.si/s/15958961-4f63-4c22-9561-984a4cecc198 ## ClickLock Stealer's dangerous game Discovered by Group-IB, the new ClickLock Stealer malware deceives Mac users with a fake Cloudflare CAPTCHA. Users are tricked into pasting a specific command in Terminal, which installs the malware. The software then locks the user's Mac with a fake login window. ## How it operates Once installed, the malware locks the user's Mac and forces them to enter a password. After the password is entered, the malware starts running in the background. It terminates all visible applications every 210 milliseconds, coercing the user to comply. ## Targeted data ClickLock Stealer captures sensitive information such as browser credentials, crypto wallet extensions, desktop wallet files, and password manager data. This information is then transferred to malicious actors for financial gain. ## Targeted countries The malware primarily targets users in Italy, the U.S., Jordan, and the UK. Group-IB notes that this geographic distribution correlates with high-income regions where cryptocurrency adoption and macOS market share are significant. ## Protection methods To avoid such threats, users should refrain from downloading software from unknown sources. Suspicious links in emails or messages should not be opened. Obtaining apps from the Mac App Store or the developer's official site is the safest approach. ## Additional security measures Users can protect their systems by using security software. Following security guides from sources like Macworld and avoiding cracked software will provide additional protection against such threats. ## Sources covering this story - https://www.macworld.com/article/3193904/new-mac-malware-pretends-to-be-a-login-box-to-steal-your-data.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._