New Infinity Stealer malware grabs macOS data via ClickFix lures
Recorded: March 28, 2026, 7 p.m.
| Original | Summarized |
New Infinity Stealer malware grabs macOS data via ClickFix lures News Featured Popular LiteLLM PyPI package backdoored to steal credentials, auth tokens HackerOne discloses employee data breach after Navia hack Firefox now has a free built-in VPN with 50GB monthly data limit Infinite Campus warns of breach after ShinyHunters claims data theft New Infinity Stealer malware grabs macOS data via ClickFix lures Learn 71 languages in one science-backed app while it’s on sale Backdoored Telnyx PyPI package pushes malware hidden in WAV audio Fake VS Code alerts on GitHub spread malware to developers Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityNew Infinity Stealer malware grabs macOS data via ClickFix lures New Infinity Stealer malware grabs macOS data via ClickFix lures By Bill Toulas March 28, 2026 A new info-stealing malware named Infinity Stealer is targeting macOS systems with a Python payload packaged as an executable using the open-source Nuitka compiler. ClickFix step used in Infinity attacksSource: Malwarebytes The malware's disassembly viewSource: Malwarebytes Automated Pentesting Covers Only 1 of 6 Surfaces. Related Articles: ClickFix Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories Kali Linux 2026.1 released with 8 new tools, new BackTrack mode European Commission investigating breach after Amazon cloud account hack TP-Link warns users to patch critical router auth bypass flaw Sponsor Posts Overdue a password health-check? Audit your Active Directory for free Is your program ready for agentic GRC? See what shift enterprise teams need to make. Synthetic Identities, Proxies & Real Identities for Sale, is yours next? Are your AI accounts being sold on the dark web? Check for free. AI is a data-breach time bomb: Read the new report Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
New Infinity Stealer malware represents a significant escalation in macOS threat landscape, utilizing a sophisticated attack chain centered around the ClickFix technique and compiled with the Nuitka compiler. According to Malwarebytes’ research, this is the first documented instance of combining ClickFix delivery with a Python-based infostealer compiled with Nuitka, presenting a novel approach to macOS malware. The attack highlights the evolving tactics employed by threat actors to evade traditional security measures. The core of the attack begins with a deceptive lure presented via the update-check.com domain, mimicking a Cloudflare CAPTCHA challenge, prompting the user to input a base64-obfuscated curl command into the macOS Terminal. This command initiates a sequence of actions designed to execute the subsequent stages of the malware. First, the command decodes a Bash script that writes the stage-2 Nuitka loader to the /tmp directory, removes the quarantine flag, and then executes it using 'nohup,' ensuring it continues running even if the Terminal window is closed. Finally, the script transfers the command and control (C2) server address and token through environment variables, followed by deleting itself and closing the Terminal window. The stage-2 component is an 8.6 MB Mach-O binary, utilizing Nuitka to compile the Python script into a native executable, rendering static analysis considerably more difficult. This binary contains a 35MB zstd-compressed archive, which unpacks the stage-3 component, identified as UpdateHelper.bin, functioning as the primary Infinity Stealer malware itself. A critical step within this malware is an anti-analysis check; the malware checks the environment for virtualization or sandboxing, adapting its behavior accordingly. Once operational, the Infinity Stealer payload, written in Python 3.11, initiated a data harvesting campaign. This campaign targeted widespread data theft, including screenshots, macOS Keychain entries, cryptocurrency wallets, and plaintext secrets stored within developer files like .env files. The malware’s exfiltration process utilized HTTP POST requests directed to the C2 server, simultaneously transmitting a Telegram notification to the actors upon successful data collection. This multi-layered approach—immediate notification and data transit—demonstrates a timely response characteristic of advanced attackers. Malwarebytes’ analysis underscores the increasing sophistication of threats against macOS users. The use of Nuitka and the ClickFix technique demonstrates a commitment to covert malware development, making detection considerably more challenging for conventional security tools. This malware highlights the need for users to exercise extreme caution when interacting with unknown commands or links, particularly those delivered via seemingly legitimate verification mechanisms. The attack signifies a heightened level of threat intelligence targeting macOS systems, suggesting a more targeted and persistent approach by the attacker group. Users should prioritize awareness and implement best practices to prevent falling victim to such sophisticated malware campaigns. |