Safe Mode: Recommended Cleanup Procedure for ClickLock
Safe Mode is recommended by Group-IB for cleaning up ClickLock Stealer infections, as it prevents LaunchAgents from loading.
Tag: macOS
ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password
Group-IB has identified a new macOS infostealer, ClickLock Stealer, that uses a coercive technique to force victims to enter their login password.…
ClickLock Stealer: macOS Stealer Using ClickFix Technique
ClickLock Stealer is a macOS stealer family that uses phishing pages employing the ClickFix technique to target users in Europe, North America,…
goyim: Backdoor Component of ClickLock Stealer
goyim is a backdoor component used in ClickLock Stealer, largely a copy of the GSocket open-source tunneling toolkit. It provides an encrypted…
SHub Stealer: macOS Malware Using dscl Validation
SHub Stealer is a macOS malware documented by Microsoft that uses dscl for password validation, similar to ClickLock Stealer. It was part…
MacSync: macOS Stealer
MacSync is a macOS stealer that targets user credentials and data. AmnesiaStealer is compared to MacSync in terms of overall objectives, but…
macOS Terminal Application
The macOS Terminal app is used in the ClickFix technique of the DPRK malvertising campaign. Victims are tricked into pasting a malicious…
Keychain: macOS Password Manager Targeted by ClickLock
The macOS Keychain, which stores passwords and credentials, is exfiltrated by ClickLock Stealer after the victim enters their login password.
macOS LaunchAgent Persistence Mechanism
LaunchAgent is a macOS persistence mechanism used by the Node.js backdoor in the DPRK malvertising campaign to maintain access on infected systems.
Gatekeeper: macOS Security Feature Bypassed by ClickLock
Gatekeeper is a macOS security feature that is bypassed by ClickLock Stealer by killing NotificationCenter, preventing security warnings from appearing.