Hackers Use Paste-and-Run Commands to Deploy ClickLock Stealer Against Mac Users

ClickLock Stealer is an actively observed macOS infostealer campaign that tricks users into pasting malicious terminal commands via fake verification pages (paste-and-run/ClickFix technique) to install modular stealers and a persistent GSocket-based backdoor; it harvests macOS credentials, Keychain items, browser passwords, and cryptocurrency wallet data and exfiltrates results via Telegram bots and compromised domains, with Group-IB telemetry linking activity since May 2026 to at least ~100 victims across 33 countries.