Picture a Mac that screams at you for three straight days until you hand over your password. That is ClickLock. Security researchers at Group-IB, writing in a report covered by techradar.com, describe a macOS infostealer that spams system password prompts every 210 milliseconds while killing Finder, Dock and Terminal in the background.
If you host Mac-friendly development stacks, design studios or remote Mac freelancers on reseller infrastructure, your clients are squarely in the blast radius.
Quick take
- Group-IB discovered ClickLock, a macOS-focused infostealer.
- Active since at least May 2026 and spotted in 33 countries, mostly in Europe.
- Distributed through ClickFix-style social engineering campaigns.
- Steals browser data, crypto wallets, password manager vaults, FTP configs and device info.
- Exfiltrates everything via the Telegram Bot API inside a .ZIP archive.
- A sample submitted to VirusTotal in early June went undetected by all vendors at the time.
How ClickLock actually works
The malware's punchline is not clever code. It is social pressure. It opens a fake authentication dialog on a loop. Every 210 milliseconds it also kills core macOS apps so the user cannot pivot to a terminal or activity monitor to investigate. The loop runs for more than 72 hours, or until the victim gives up and types their password.
After it captures the password, ClickLock pulls saved logins and cookies from major browsers, grabs crypto wallet extensions and password manager records, reads shell histories, lifts FileZilla server profiles and collects basic host fingerprinting data. Cached addresses tied to several blockchain families are targeted too. Everything is bundled and sent to the attacker through a Telegram bot.
Group-IB has not tied the campaign to a named threat actor, and it says the malware circulated for weeks before any vendor flagged it.
Our analysis
Two things make ClickLock relevant to a hosting audience even though the victims are end users, not servers.
First, the stolen FileZilla configuration. FTP creds harvested from a designer or freelancer are exactly the kind of credential that gets typed into a cPanel account at 2am. If a reseller client uploads via FTP — and plenty of legacy WordPress workflows still do — a ClickLock infection means your client's hosting panel is now in a Telegram bot's hands.
Second, the password manager vault. Modern password managers are the single source of truth for hosting credentials, registrar logins, DNS provider tokens and SSH keys. If ClickLock exfiltrates that vault, the blast radius covers every provider the victim touches, not just one site.
Group-IB's note that the malware went undetected on VirusTotal for weeks is the most important sentence for resellers. Your default trust lists and AV integrations are not enough. Defence has to assume the user might type their password under duress.
Worked example: tightening the Mac freelance workflow you host
Say you provide managed WordPress hosting and SFTP access to a small design studio. Four of their designers work on M-series MacBooks and use 1Password for everything. They have not enabled System Password protection beyond the lock screen.
A reasonable hardening pass you could recommend or bundle:
- Move from FTP to SFTP-only with key authentication; remove password logins on the server side.
- Enable macOS System Password prompts and a short lockout, so a looping prompt is harder to dismiss without thought.
- Push clients to use hardware-key 2FA on your control panel and on their password manager.
- Rotate any FTP or panel credentials that may have lived on a Mac that saw a suspicious prompt storm.
- For your own support staff: a written rule that any client report of "weird password popups" is a P1 incident, not a curiosity ticket.
What to watch next
Watch for Apple to ship behaviour-based detections targeting apps that aggressively kill system processes. Watch for Telegram to act on the bot endpoints Group-IB identified. Watch for ClickLock copycats — the ClickFix template is cheap to copy and Group-IB's victim geography says Europe is the soft target.
Bottom line: this is not exotic malware. It is a tired user with a broken Mac and no off-ramp. Resellers should ship a one-page client advisory today and tighten FTP and panel policies this week.
Key takeaways
- ClickLock weaponises annoyance, not zero-days; user training is the first defence.
- Stolen FTP configs put cPanel and WordPress admin panels directly at risk.
- Move clients to key-based SFTP and enforce 2FA on every hosting control panel.
Frequently asked questions
What is ClickLock in plain terms?
It is a macOS infostealer that spams password prompts every 210 milliseconds and kills common apps until the victim enters their password, then steals browser, wallet and FTP data.
How is ClickLock spread?
Group-IB says it is distributed through ClickFix social engineering campaigns, which typically trick users into running malicious commands or pasting code into Terminal.
Which countries have seen infections?
Group-IB reports detections in 33 countries, with the majority in Europe.
Why does this matter for hosting resellers specifically?
Stolen FTP credentials and password manager vaults harvested from Mac users often unlock cPanel, WHM and WordPress admin accounts hosted by resellers.
What is the single fastest mitigation for resellers?
Disable password-based FTP and SSH on your servers, require key-based auth, and turn on 2FA on every client-facing control panel.