Loading threat actor…
ClickLock Dev is the operator associated with ClickLock Stealer, a modular macOS-focused infostealer operation active since at least May 2026. The activity is centered on social-engineering-driven initial access using ClickFix-style phishing pages that trick victims into pasting malicious commands into Terminal rather than relying on privilege escalation or software exploits. The operation has targeted at least 100 victims across 33 countries, with a strong concentration in Europe. The malware stack is composed of multiple components that work together to steal credentials and maintain access. Observed functionality includes theft of the macOS login password, extraction of the Chrome Safe Storage key from Keychain, collection of browser cookies, saved passwords and autofill data, harvesting of password-manager data, theft of cryptocurrency wallet data, collection of shell history, and theft of FTP credentials. The operation also deploys a modified GSocket-based backdoor to preserve persistent remote access after the primary theft workflow completes. ClickLock Dev uses aggressive coercion and defense-evasion techniques during execution. The malware repeatedly kills user-facing processes and security-notification mechanisms to pressure victims into approving prompts and entering valid credentials. Persistence is established through LaunchAgents so the credential-theft workflow can resume after login if interrupted. Additional anti-forensic behavior includes hidden storage locations, timestamp forgery, self-deletion of components, and cleanup actions intended to reduce forensic visibility. The actor’s tooling demonstrates capabilities spanning reconnaissance, credential theft, crypto-focused data harvesting, exfiltration, persistence, post-exploitation, and defense evasion. Exfiltration has been conducted through Telegram, and the retained backdoor provides ongoing remote shell access. The operation is best characterized as financially motivated cybercrime focused on stealing credentials and cryptocurrency-related assets from macOS users.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 malware family attributed to this actor across reporting.
14 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.