ClickLock Stealer: Paste Once, Lose Everything

## Executive summary Group-IB reports on 'ClickLock Stealer', a newly observed modular macOS infostealer that leverages ClickFix paste-based social engineering to coerce users into granting credentials and Keychain access, harvests browser/password manager/desktop wallet data (including Chrome Safe Storage key and multiple crypto wallet extensions), and installs a persistent GSocket-based backdoor; components exfiltrate data via Telegram and compromised WordPress domains, the operation targeted ~100 victims in 33 countries and employed anti-forensic timestomping and self-deletion to evade detection.