New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password

ClickLock Stealer, a new macOS infostealer, answers a victim's refusal by killing their apps on a loop until they hand over the login password. It arrives as a command pasted into Terminal, asks for the password behind a fake system dialog, and when the victim cancels, installs two LaunchAgents and quietly exits. At the next login, Finder, the Dock, Spotlight, Terminal, Activity Monitor, and

The article describes ClickLock Stealer, a new macOS infostealer that uses aggressive social engineering and process-killing behavior to coerce users into entering their login password into a fake prompt, then steals credentials, browser data, crypto wallet information, and Keychain contents, exfiltrating them to an attacker-controlled Telegram bot.[1][4][5] It is delivered via commands pasted into Terminal and persists via LaunchAgents so that, on next login, it repeatedly kills Finder, Dock, Spotlight, Terminal, Activity Monitor, and major browsers every 210 ms until a valid password is supplied.[1][2][3][4] From a RealGround perspective, this is not an AI-specific exploit but a sophisticated malware campaign that could be integrated into broader automated or AI-assisted attack workflows. The practical implication for AI security is that any AI-powered agents operating on endpoints, or orchestrating system automation, must be red-teamed to ensure they cannot be tricked into executing unvetted shell commands, installing persistence mechanisms, or assisting with coercive credential harvesting, making Continuous AI Red Teaming critical to test and harden such AI workflows ag