macOS Malware Steals Browser and Wallet Data via Fake CAPTCHA Prompt

A new macOS malware called ClickLock terminates running applications and security tools while displaying a malicious system password prompt. Forbes reported that the malware first appeared on June 9 and uses a fake Cloudflare CAPTCHA verification screen to trick users into pasting commands into the Terminal application.

An incorrect password entry triggers a dialogue loop that lasts 300,000 seconds, or 83 hours, showing only the password screen.

The loop continues even after system reboots and ends only when the correct password is supplied. The malware targets data from eight browsers, 31 crypto wallet browser extensions, seven password manager extensions, and eight desktop wallet applications. It also extracts blockchain addresses across six chains, macOS Keychain contents, shell history, and FTP credentials.

Attacks have been observed in 33 countries with at least 100 confirmed victims. Forbes reported that the malware remains under active development according to analysis of its code structure.