Malware News Infiniti Stealer: a new macOS infostealer using ClickFix and Python/Nuitka

[Brownie2019]

Content source

https://www.malwarebytes.com/blog/threat-intel/2026/03/infiniti-stealer-a-new-macos-infostealer-using-clickfix-and-python-nuitka

A previously undocumented macOS infostealer has surfaced during our routine threat hunting. We initially tracked it as NukeChain, but shortly before publication, the malware’s operator panel became publicly visible, revealing its real name: Infiniti Stealer.

This malware is designed to steal sensitive data from Macs. It spreads through a fake CAPTCHA page that tricks users into running a command themselves: a technique known as ClickFix. Instead of exploiting a bug, it relies on social engineering.

The final payload is written in Python and compiled with Nuitka, producing a native macOS binary. That makes it harder to analyze and detect than typical Python-based malware.

To our knowledge, this is the first documented macOS campaign combining ClickFix delivery with a Nuitka-compiled Python stealer.

Read more:

Infiniti Stealer: a new macOS infostealer using ClickFix and Python/Nuitka

A new macOS infostealer, NukeChain (now Infiniti Stealer), uses fake CAPTCHA pages to trick users into running malicious commands.

www.malwarebytes.com

 

[Bot]

Read more:

Infiniti Stealer: a new macOS infostealer using ClickFix and Python/Nuitka

A new macOS infostealer, NukeChain (now Infiniti Stealer), uses fake CAPTCHA pages to trick users into running malicious commands.

www.malwarebytes.com

This is a notable campaign because it combines a very effective delivery trick with a payload format that can complicate analysis.

Why this matters

• The ClickFix part is important because it gets the user to execute the command manually. That can bypass the usual expectation that malware must exploit a software vulnerability.
• Targeting macOS is also notable. A lot of users still assume Mac systems are less likely to be targeted, but infostealers for macOS are very real.
• Using Python compiled with Nuitka is interesting from a defender’s point of view because it can make a Python threat look more like a native application and may slow down casual analysis.

Practical takeaway

For most users, the main defense here is not a patch for a specific bug, but avoiding the execution chain entirely:

• Do not run Terminal commands copied from CAPTCHA or “verification” pages.
• Be suspicious of sites that claim you must paste a command to continue, prove you are human, or unlock content.
• Use browser protection, DNS/web filtering, and reputable endpoint security to reduce exposure to malicious landing pages.
• If a system may have been exposed, treat it as a credential-theft risk and rotate passwords from a clean device.

Security angle

The social-engineering aspect is probably the bigger lesson than the Nuitka detail. Packaging is technically interesting, but the real success factor is convincing the victim to self-install the stealer.

If the Malwarebytes reporting is accurate, this also reinforces a broader trend: attackers are increasingly adapting Windows-focused social engineering methods for macOS users as well.

For defenders

Useful next steps would usually include:

• Reviewing shell history and recent Terminal activity on potentially affected Macs
• Checking for suspicious persistence items such as LaunchAgents or LaunchDaemons
• Looking for unusual outbound connections after user-executed shell commands
• Resetting browser-stored credentials, session tokens, and crypto-wallet access if compromise is suspected

Conclusion

The key point is not just “new macOS stealer,” but that ClickFix-style user execution is now being paired with more polished macOS payload delivery. That makes user awareness and post-exposure credential hygiene especially important here.

Source

• Infiniti Stealer: a new macOS infostealer using ClickFix and Python/Nuitka

 

[Halp2001]

I am not a macOS user, but it’s interesting to see how the "Macs are immune to malware" myth continues to be debunked. This ClickFix technique is a perfect example of how attackers target the human element through social engineering rather than just software vulnerabilities.

For home users, the lesson remains the same regardless of the OS: be extremely cautious with "fake CAPTCHAs" or any site asking you to manually run commands. Safety starts with user awareness.

 

[ForgottenSeer 123960]

Executive Summary

Confirmed Telemetry
Indicates that "Infiniti Stealer" is a macOS-targeted infostealer delivered exclusively via ClickFix social engineering campaigns (fake CAPTCHA pages).

Assessment
Indicates that by compiling the Python 3.11 payload into a native Mach-O binary using Nuitka, the threat actors successfully evade traditional Python-based heuristic detections while systematically exfiltrating Keychain entries, cryptocurrency wallets, and browser credentials.

Technical Analysis & Remediations

MITRE ATT&CK Mapping

T1204.002
User Execution: Malicious File (ClickFix CAPTCHA lures).

T1059.004
Command and Scripting Interpreter: Unix Shell (Initial Bash dropper).

T1140
Deobfuscate/Decode Files or Information (Base64 decoded curl commands).

T1555.001
Credentials from Password Stores: Keychain.

T1552
Unsecured Credentials: Plaintext secrets in developer files (.env).

CVE Profile
NVD Score: N/A (Social Engineering)
CISA KEV Status: Inactive.
The malware does not exploit a software vulnerability; it abuses legitimate macOS administrative utilities.

Telemetry

Hashes
MD5 (Dropper)
da73e42d1f9746065f061a6e85e28f0c

SHA256
(Stage-3 Payload)
1e63be724bf651bb17bcf181d11bacfabef6a6360dcdfda945d6389e80f2b958

Network (Refanged)
hxxps://update-check[.]com
(C2 / Payload Delivery)

hxxps://update-check[.]com/m/7d8df27d95d9 (Stage 1 Dropper)

hxxps://Infiniti-stealer[.]com
(Operator Panel)

Artifacts

Directory structures
/tmp/.2835b1b5098587a9XXXXXX

Debug Log
/tmp/.bs_debug.log

Packer Magic
4b 41 59 28 b5 2f fd
(Nuitka KAY + zstd compression)

The structure indicates execution evasion routines by checking for Sandbox environments (VMware, VirtualBox, any.run, Joe Sandbox, Hybrid Analysis).

Remediation - THE ENTERPRISE TRACK (NIST SP 800-61r3 / CSF 2.0)

GOVERN (GV) – Crisis Management & Oversight

Command
Initiate incident response protocols for potential credential compromise affecting developer environments and enterprise single sign-on (SSO) tokens.

DETECT (DE) – Monitoring & Analysis

Command
Deploy EDR hunting queries targeting Terminal execution of curl piped to bash explicitly containing base64 --decode logic.

Command
Alert on anomalous execution of xattr -dr com.apple.quarantine originating from /tmp directories.

RESPOND (RS) – Mitigation & Containment

Command
Isolate affected macOS endpoints from the corporate network immediately.

Command
Block domains update-check[.]com and Infiniti-stealer[.]com at the secure web gateway and DNS levels.

RECOVER (RC) – Restoration & Trust

Command
Force global password resets and revoke all active session tokens, SSH keys, and API tokens for affected users.

IDENTIFY & PROTECT (ID/PR) – The Feedback Loop

Command
Implement Endpoint Privilege Management (EPM) to restrict standard users from executing unapproved scripts in Terminal.

Command
Conduct security awareness training focusing specifically on ClickFix methodologies and fake CAPTCHA human-verification lures.

Remediation - THE HOME USER TRACK (Safety Focus)

Priority 1: Safety

Command
Disconnect the affected Mac from the internet immediately to halt ongoing data exfiltration.

Command
Do not log into banking, email, or cryptocurrency wallets from the compromised device until it is verified clean.

Priority 2: Identity

Command
Reset all critical passwords (Apple ID, banking, primary email) and ensure MFA is enabled using a known clean device (e.g., your smartphone on a cellular network).

Priority 3: Persistence

Command
Check /tmp/ for hidden files (e.g., .bs_debug.log) and audit ~/Library/LaunchAgents/ for unauthorized persistence mechanisms.

Command
Run a comprehensive scan using a reputable anti-malware solution designed for macOS to eradicate the Stage-2 and Stage-3 Nuitka payloads.

Hardening & References

Baseline
Apply CIS Apple macOS Benchmarks to restrict terminal execution policies and enforce strict Gatekeeper configurations.

Framework
NIST CSF 2.0 PR.AT-1 (Identity Management and Authentication) and PR.DS-1 (Data-at-rest protection for developer secrets).

Note
Native macOS binaries compiled via Nuitka bypass standard Python script detection. Detection engineering must focus on the behavioral execution chain (Terminal -> curl -> /tmp execution) rather than static file analysis alone.

Source

Malwarebytes Threat Intelligence

 

[simmerskool]

... Objective See app BlockBlock 2.4.2 has protection for clickfix. And macOS does run Gatekeeper, Xprotect & Xprotect Remediator... So the question does it need an AV is somewhat misleading, it does have malware protection.