ClickLock Stealer: Another crypto stealer malware on MacOS

[SatsPH]

Another MacOS malware is in the wild, dubbed ClickLock as it combines ClickFix + Locker technique. This malware will forced you to enter your login password as it will terminate all visible processes.

And it targets the following:

• 8 web browsers
• 31 cryptocurrency wallet browser extensions
• 7 password manager extensions
• 8 desktop cryptocurrency wallet applications
• Blockchain addresses across 6 different networks
• macOS Keychain
• Shell history
• FTP credentials

And base on their findings, their lure their victims thru ClickFix, that trigger a fake Cloudflare “human verification” sequence with an animated progress bar. And then after that, keyboard are being disabled and the malware modules are being downloaded from the background.



After the module has been executed, it will display a fake password dialog box. And if the users enters his data, exfiltrates it to the attacker via Telegram.

So again, with this recent spat of attacks on MacOS users, we need to be very vigilant time and time again.

https://www.group-ib.com/blog/clicklock-stealer-macos-malware/

[joniboini]

So again, with this recent spat of attacks on MacOS users, we need to be very vigilant time and time again.

I assume this means the userbase of MacOS is getting bigger, or attackers believe they have a higher chance of having a decent stock of crypto or other assets when they use MacOS. I remember reading another report about MacOS malware just a few days ago.

This new malware seems to be a month old, judging from when it was first discovered. Looks like their script managed to fool quick scanner like VirusTotal if I'm reading correctly. I wonder if their existing model doesn't share any similarity with previous malwares on their database or if there is other reasons for that.