Back Timesnownews

This New macOS Malware Won't Stop Crashing Apps Until It Gets Your Password

Timesnownews • July 17, 2026

Mac users are at a major risk because of a new macOS Infostealer dubbed ClickLock Stealer. It answers victims' refusal by killing all their applications in a loop until they give in their login password. It comes as a command pasted into Terminal, asks for the password behind a fake system dialogue, and when the victim cancels, it installs two LaunchAgents and exits. As soon as you log in , all major apps like Finder, the Dock, Spotlight, Activity Monitor, and Terminal start dying every 210 milliseconds for the 83 hours, and the only thing you will see is a password box on a dead desktop.

According to GroupIB, the malware has already affected a minimum of 100 targets in around 33 countries by May 2026, and half of them belong to Europe. As per their analysts, the malware is still under development. The orchestrator has zero detections there when GroupIB analysed it. Now, these things don't happen every day, but anyone can become a victim if they are not careful enough with the stuff that is going around or on their systems.

And this is not it, another malware is also wreaking havoc on macOS, and this one is called CrashStealer. According to a report published by Jamf threat Labs, the malware impersonates Apple's crash reporting framework, and it steals a lot of sensitive information. CrashStealer can collect browser data, password manager data, cryptocurrency wallet extensions, and keychain data as well. As per the report, it was first spotted in a fake Apple-notarised app dubbed Werkbit. With notarization, the malware is not stopped by Gatekeeper, which is a part of the macOS security system. What's more disturbing is that this one targets more than 80 cryptocurrency wallet extensions and 14 password managers like 1Password, Dashlane, and LastPass. It goes through the Documents and Downloads folders to look for information worth stealing.

A career journalist who spent six years playing around with smartphones, apps and gaming. As a hobby, Rudra enjoys researching mobile games, watching ... View More

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New ClickLock Malware Holds Mac Users Hostage for Passwords A new macOS malware strain named ClickLock is targeting Mac users by preventing access to their computers until they provide their login passwords. The malware employs social engineering tactics, displaying fake Apple password prompts and repeatedly crashing key macOS processes, including Finder and Terminal, every 210 milliseconds. Researchers at Group-IB report that ClickLock has already infected over 100 systems across 33 countries since May 2026. The malware is believed to initiate through a ClickFix-style attack, tricking users into executing a command in Terminal. Once the correct password is entered, ClickLock not only steals it but also targets sensitive data such as browser profiles and cryptocurrency wallets. The malware's persistence mechanisms can keep users trapped in a cycle for over 83 hours. Additionally, another malware called CrashStealer is also affecting macOS, which impersonates Apple's crash reporting framework to steal sensitive information. 4 sources 65

Extracted Entities

This New macOS Malware Won't Stop Crashing Apps Until It Gets Your Password

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)