New threat macOS malware ClickLock Stealer

New perils macOS Malware ClickLock Stealer at Just Paste, Data Stealable

According to a report by the official website of the developer of the famous anti-malware tool Malwarebytes, Malwarebytes has mentioned the detection of a malware type that steals data from the victim's system or a new Infostealer called ClickLock Stealer that specifically focuses on attacks on users of the macOS operating system. This malware was detected by a research team from Group-IB, a cybersecurity specialist from Singapore. The research team found that hackers would start by deceiving the victim by phishing the victim into a fake website. The fake website takes the victim to a fake Verification screen, tricking the victim into opening the Terminal application and placing the code on it. Screen This is a method called ClickFix that tricks the victim into following commands to download and install malware on the machine manually. In addition to installing malware theft, the system's back-door or backdoor malware is installed, called GSocket, to facilitate hackers to access the system at any time.

After the victim has installed the malware on the victim's machine, the malware will bounce up a fake screen to trick the victim into filling in the system password by force. If the victim refuses to enter the password, the malware will shut down key functions on the system, such as Finder, Dock, Terminal, Activity Monitor, Console, System Settings, Spotlight, and web browsers, until the victim has entered the password. The key shutdown will loop every 210 seconds to 83 hours until the victim completes the correct password. If the victim completes the requested password, the system will activate it, but behind the malware, it will send the password, as well as other information previously stolen by the malware, back to hackers on the control server (C2 or Command and Control) located on the famous chat service Telegram for verification and further use.

After the malware has finished stealing the data, the malware will delete itself to evade detection, but the GSocket malware will not be deleted to allow hackers to resume data theft by reinstalling the same malware or secretly installing other malware on the system to deal with the hacker's indulgent machine.

# Trending # lemon 8 diary # macos # freedomhack # Malware