Infiniti Stealer macOS malware represents a significant shift in how attackers target Apple users. Discovered by Malwarebytes Labs in March 2026, this infostealer combines ClickFix social engineering—a technique that tricks users into pasting malicious commands into Terminal—with Nuitka-compiled Python code, making it harder to detect and analyze than typical Python malware. The campaign marks the first documented macOS attack merging these two techniques, and it is actively spreading via fake Cloudflare CAPTCHA pages.
Key Takeaways
- Infiniti Stealer uses fake Cloudflare CAPTCHA pages to trick macOS users into pasting malicious Terminal commands
- The malware steals browser credentials, Keychain entries, cryptocurrency wallets, and developer secrets from .env files
- Three-stage infection chain includes a Bash dropper, Nuitka-compiled loader, and Python payload that exfiltrates data via HTTP POST
- Malware includes anti-analysis checks for sandboxes like VMware, VirtualBox, and any.run to evade detection
- If infected, immediately stop using the device for sensitive activity and change passwords on a clean device
How Infiniti Stealer Spreads via ClickFix
The attack begins when users visit a malicious domain, update-check[.]com, which displays a fake CAPTCHA mimicking Cloudflare’s design. The page instructs victims to copy and paste a base64-obfuscated curl command directly into macOS Terminal. This social engineering tactic, known as ClickFix, exploits user trust in familiar security prompts and the assumption that pasting a command into Terminal is safe. Most users do not realize they are executing a malicious script that will compromise their system.
Once the command runs, a three-stage infection unfolds. First, a Bash dropper script decodes and downloads the second stage—an 8.6 MB Nuitka-compiled loader—and writes it to the /tmp directory. The script removes the quarantine flag that macOS applies to downloaded files, executes the loader via nohup (a Unix utility that allows processes to run in the background), and then self-deletes to cover its tracks. The Terminal window closes automatically, leaving users unaware of what just happened.
The second stage is where Nuitka’s native compilation becomes significant. Unlike traditional Python scripts, Nuitka compiles Python code into native macOS binaries, making the malware harder for security tools to recognize and analysts to reverse-engineer. The loader extracts a 35MB zstd-compressed archive containing the final payload, UpdateHelper.bin, which is the actual Infiniti Stealer.
What Infiniti Stealer Malware Extracts from Your Mac
Once active, Infiniti Stealer targets the most valuable data on a macOS system. It harvests credentials from Chromium-based browsers—Chrome, Edge, Brave, and others—as well as Firefox, capturing saved usernames and passwords. It also accesses macOS Keychain, the system’s native password manager, which stores credentials for email accounts, Wi-Fi networks, and applications. Cryptocurrency wallets stored on the device are prime targets, as are plaintext secrets in .env developer configuration files, which often contain API keys and database credentials.
The malware also captures screenshots, providing attackers with visibility into what users are doing on their machines. All stolen data is exfiltrated via HTTP POST requests to a command-and-control (C2) server, and the operators receive a Telegram notification when the theft is complete. This notification system confirms the attackers are running an organized, structured campaign rather than a one-off exploit.
Malwarebytes researchers noted that the perception of macOS as a low-risk malware target is rapidly fading. Infiniti Stealer is part of a broader wave of macOS infostealers—including DigitStealer, MacSync, Atomic macOS Stealer (AMOS), and Eternidade Stealer—that have emerged since late 2025, adapting Windows-focused techniques like ClickFix to Apple’s ecosystem. These campaigns demonstrate that attackers are increasingly willing to invest in macOS-specific malware as the platform’s market share and user wealth make it an attractive target.
Anti-Analysis Tricks and Evasion
Infiniti Stealer includes several anti-analysis features designed to prevent security researchers from studying it in sandbox environments. The malware checks for the presence of analysis platforms like any.run, Joe Sandbox, Hybrid Analysis, VMware, and VirtualBox. If detected, it will refuse to execute, preventing researchers from safely triggering its behavior in isolated lab environments. The malware also adds randomized execution delays, further complicating analysis by making its behavior unpredictable.
These evasion techniques underscore how sophisticated modern infostealers have become. By avoiding detection in sandboxes, the malware is more likely to slip past security researchers and automated detection systems that rely on behavioral analysis in controlled environments.
What to Do If Your Mac Is Infected
If you believe your macOS device has been compromised by Infiniti Stealer, immediate action is critical. First, stop using the device for any sensitive activity—banking, email, work accounts, or cryptocurrency transactions. The attacker now has access to your credentials and is monitoring your activity.
Second, change all your passwords on a clean device (not the infected Mac), starting with your email account, banking credentials, and Apple ID. Email is the master key to your digital life; if attackers control it, they can reset passwords for other services. Your Apple ID controls access to iCloud, App Store, and device recovery, making it equally critical.
Third, revoke access to any active sessions and invalidate API tokens and SSH keys. Log out of your accounts from other devices, revoke third-party application access in your account settings, and rotate any API credentials or SSH keys used for development or cloud access. Check for suspicious files in /tmp and other temporary directories, though the malware typically cleans up after itself.
Finally, consider whether you need to notify your bank, cryptocurrency exchanges, or employer, depending on what credentials were stored on the device. Some financial institutions and exchanges have fraud monitoring that can flag suspicious login attempts from new locations or devices.
How to Stay Safe from ClickFix and Similar Attacks
The most effective defense is skepticism. Never paste commands from websites into Terminal, especially if prompted by a security warning or CAPTCHA page. Legitimate security updates come through official channels—the App Store, System Settings, or your company’s IT department—not from random web pages. If you see a CAPTCHA asking you to run a Terminal command, it is almost certainly a scam.
Keep your macOS operating system and all applications updated. Security patches close vulnerabilities that malware exploits to gain initial access. Enable FileVault encryption so that even if your device is stolen or compromised, the attacker cannot easily access your files. Use a password manager like 1Password or Bitwarden instead of relying on browser password storage; these tools are more resistant to malware theft than built-in browser credential stores.
Consider using a dedicated device or virtual machine for high-risk activities like cryptocurrency trading or accessing sensitive financial accounts. If you work in software development, store API keys and secrets in environment variable managers or secret vaults rather than in plaintext .env files on your disk.
Is Infiniti Stealer targeting specific regions or industries?
The research brief does not specify geographic targeting or industry focus. The malware appears to be a general-purpose infostealer designed to compromise any macOS user, regardless of location or profession. However, developers and cryptocurrency users are likely higher-value targets given the malware’s interest in .env files and wallet data.
Can antivirus software detect Infiniti Stealer?
Traditional antivirus detection relies on known malware signatures. Since Infiniti Stealer uses Nuitka-compiled Python and obfuscated code, it may evade signature-based detection. Behavior-based detection tools that monitor suspicious system calls, network activity, or file access might catch it, but the malware’s anti-analysis checks are designed to avoid triggering in sandbox environments where such tools are tested. The best defense remains user awareness—never paste Terminal commands from untrusted sources.
Should I be worried about Infiniti Stealer if I use Linux or Windows?
Infiniti Stealer specifically targets macOS. However, the broader trend of Python-based infostealers adapting Windows techniques suggests that Windows and Linux users should remain vigilant against similar ClickFix attacks and other social engineering campaigns. The attack surface is expanding across all platforms.
Infiniti Stealer demonstrates that macOS is no longer a low-risk target for attackers. The combination of ClickFix social engineering and Nuitka-compiled Python creates a potent attack vector that is difficult to detect and analyze. The key to protection is understanding how the attack works—users must recognize that no legitimate service will ask them to paste commands into Terminal—and taking immediate action if they suspect compromise. Change your passwords, revoke access, and monitor your accounts for suspicious activity. The threat is real, but awareness and swift response can limit the damage.
Edited by the All Things Geek team.
Source: TechRadar
