Infiniti Stealer: a new macOS infostealer using ClickFix and Python/Nuitka
A new macOS infostealer called Infiniti Stealer has been discovered, utilizing ClickFix delivery and Python/Nuitka compilation. The malware spreads through a fake CAPTCHA page, tricking users into running a command themselves. The final payload is a Python-based stealer compiled with Nuitka, making it harder to analyze and detect. The malware targets sensitive data including browser credentials, macOS Keychain entries, cryptocurrency wallets, and developer files. It employs anti-analysis techniques and exfiltrates data via HTTP POST requests. This campaign demonstrates the adaptation of Windows-based techniques to target Mac users and showcases the increasing sophistication of macOS malware.
Pulse ID: 69c65110c392e209625c97d5
Pulse Link: https://otx.alienvault.com/pulse/69c65110c392e209625c97d5
Pulse Author: AlienVault
Created: 2026-03-27 09:42:40
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Browser #CAPTCHA #CyberSecurity #HTTP #InfoSec #InfoStealer #Mac #MacOS #Malware #OTX #OpenThreatExchange #Python #RAT #Windows #bot #cryptocurrency #AlienVault