ClickFix Campaign Fingerprints Mac Users to Deliver Crypto-Stealing Malware

ClickLock Stealer is a newly documented macOS information stealer that relies on social engineering rather than a software exploit. It is believed to arrive through ClickFix-style pages masquerading as Cloudflare verification checks, which persuade users to paste a malicious command into Terminal. The campaign matters because it turns trusted system prompts and built-in tools against Mac users, exposing browser credentials, password-manager data, Keychain material and cryptocurrency holdings while leaving a persistent backdoor.

Group-IB disclosed the malware on July 16, 2026, after finding a sample uploaded to VirusTotal on June 9 with zero detections at the time of analysis. The operation has been active since May and has targeted at least 100 victims in 33 countries, more than half in Europe. ClickLock can kill visible applications every 210 milliseconds until a user submits a login password, while harvesting data from 31 crypto-wallet browser extensions, eight desktop wallets and blockchain addresses across six networks for exfiltration through Telegram.

macOS users are increasingly being targeted by information-stealing malware, with attackers often posing as Apple, Microsoft or Google update alerts to lower their guard. Reaper is particularly significant because it both creates a system backdoor and targets cryptocurrency wallets such as MetaMask and Phantom, potentially gaining access to credentials, private keys and control of assets.

A cybersecurity company recently disclosed that Reaper uses a mix of fake Apple, Microsoft and Google software updates to trick macOS users into installing it, after which it collects wallet data and steals assets. Existing reports have not disclosed the organization that discovered it, the exact disclosure date, the number of victims or the value of losses. Users should update software only through official channels.

CleanMyMac is a macOS cleanup tool developed by MacPaw. Attackers created an imitation website and used ClickFix social engineering to trick users into pasting commands into Terminal, bypassing Gatekeeper, Apple notarization and XProtect. The threat is particularly serious because leaked recovery phrases could allow attackers to take direct control of wallet assets.

Malwarebytes disclosed on March 6, 2026, that the fake website, cleanmymacos.org, downloads SHub Stealer. The malware steals Apple Keychain contents, browser data and Telegram sessions, and scans for 23 wallet applications. It also tampers with applications including Ledger Live to capture recovery phrases. The report did not disclose the number of victims or the amount of losses.