New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password

A new macOS infostealer, known as ClickLock Stealer, has been discovered, which demands a victim's login password by killing their apps in a loop. The stealer is installed through a command pasted into Terminal and initially presents a fake system dialog to request the password. If the victim cancels the request, the stealer installs two LaunchAgents and exits. Upon the next login, the stealer begins killing various system applications, including Finder, the Dock, Spotlight, Terminal, and Activity Monitor, in an attempt to coerce the victim into providing their password. The killing of apps occurs at regular intervals of 210 milliseconds. This behavior continues until the victim enters their login password.