Listen to the episode
TLDR
A new macOS information stealer called ClickLock terminates all visible processes on your Mac, leaving you staring at a blank desktop and a login prompt that looks completely normal. The trap is engineered so you feel you must type your...
How it works
A new macOS information stealer called ClickLock terminates all visible processes on your Mac, leaving you staring at a blank desktop and a login prompt that looks completely normal. The trap is engineered so you feel you must type your...
Red flags
- Desktop suddenly freezes and every app window disappears, then a login prompt appears unprompted. The prompt looks like the standard macOS authentication but appears when you did not lock, restart, or trigger any system action. Activity Monitor, Terminal, or Force Quit cannot open, or they close immediately when launched. What to do Do not type your password into any unexpected login prompt
- disconnect from the network (turn off Wi Fi) first. Reboot into macOS Recovery (Command+R at startup) and run a reputable malware removal tool such as Malwarebytes or EDR scanner. Immediately change your macOS password and the password of any account that uses the same or similar credentials, and enable two factor authentication
What to do
- 1Do not click, pay, install apps, or share verification codes.
- 2Verify through the official website, app, or phone number typed manually.
- 3If you already interacted, block cards or accounts and report the incident.
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/new-clicklock-macos-malware-traps-users-into-revealing-login-password/FAQ
Is ClickLock macOS malware forces users to reveal login password a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Desktop suddenly freezes and every app window disappears, then a login prompt appears unprompted. The prompt looks like the standard macOS authentication but appears when you did not lock, restart, or trigger any system action. Activity Monitor, Terminal, or Force Quit cannot open, or they close immediately when launched. What to do Do not type your password into any unexpected login prompt; disconnect from the network (turn off Wi Fi) first. Reboot into macOS Recovery (Command+R at startup) and run a reputable malware removal tool such as Malwarebytes or EDR scanner. Immediately change your macOS password and the password of any account that uses the same or similar credentials, and enable two factor authentication
What should I do first?
Do not click, pay, install apps, or share verification codes.; Verify through the official website, app, or phone number typed manually.; If you already interacted, block cards or accounts and report the incident.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.