Plan
archived
ClickLock macOS Stealer Uses App-Kill Loop to Force Password Entry
- Engineer — Learn: No CVE to patch — this is a social-engineering delivery chain (ClickFix-style Terminal paste) that installs LaunchAgent persistence. Engineers with macOS fleets should understand the vector and consider restricting user ability to run arbitrary Terminal commands via MDM policy.
- SOC/IR — Plan: The two-stage behavior — LaunchAgent installation on cancel, then aggressive app-kill loop at next login — is detectable; build or tune rules for unexpected LaunchAgent creation from Terminal sessions and rapid repeated app-termination events on macOS endpoints.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.