Loading story…
Researchers identified Infiniti Stealer, a previously undocumented macOS infostealer first tracked as NukeChain and later confirmed through an exposed operator panel. The malware is delivered from update-check[.]com through a fake Cloudflare CAPTCHA page that uses the ClickFix social-engineering technique, tricking users into pasting a malicious command into Terminal instead of exploiting a software flaw. Malwarebytes said the campaign appears to be the first documented macOS operation combining ClickFix delivery with a Python stealer compiled through Nuitka.
The infection chain uses a Bash dropper and an Apple Silicon Mach-O loader that unpacks a Python 3.11 payload built to hinder analysis and detection. Infiniti Stealer collects browser credentials, macOS Keychain data, cryptocurrency wallet information, plaintext secrets from developer files, and screenshots, then exfiltrates the data via HTTP POST and alerts the operator through Telegram. The malware also checks for sandbox and virtualization environments and introduces randomized delays, indicating efforts to evade automated analysis and improve operational resilience.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers documented that Infiniti Stealer steals browser credentials, macOS Keychain data, cryptocurrency wallet information, developer-file secrets, and screenshots, then exfiltrates the data via HTTP POST and notifies the operator through Telegram. They also observed sandbox and virtualization checks and randomized delays intended to hinder analysis and detection.
The campaign was found using a fake Cloudflare CAPTCHA page on update-check[.]com to socially engineer users into pasting a malicious command into Terminal, rather than exploiting a software vulnerability. The infection chain used a Bash dropper, an Apple Silicon Mach-O loader compiled with Nuitka, and a Python 3.11 stealer.
Researchers uncovered a new macOS infostealer campaign initially tracked as NukeChain and later confirmed through an exposed operator panel to be named Infiniti Stealer. They assessed it as the first documented macOS campaign combining ClickFix delivery with a Nuitka-compiled Python stealer.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A wave of **social-engineering-driven malware delivery** is abusing “verification” and “fix” workflows to trick users into running attacker-supplied commands that install information stealers. LevelBlue reported a campaign using **fake Cloudflare-style CAPTCHA pages** on compromised websites to convince Windows users to manually execute malicious **PowerShell** commands, resulting in **StealC** deployment; StealC is described as exfiltrating browser credentials, crypto wallet data, Steam and Outlook credentials, system information, and screenshots over **RC4-encrypted HTTP** to a C2 server. Intego also identified an evolved **ClickFix** technique on macOS (“**Matryoshka**”) that leverages **typosquatting** to redirect users to pages instructing them to paste “fix” commands into Terminal; the loader then retrieves an AppleScript payload to steal browser credentials and target wallet apps (e.g., *Trezor Suite*, *Ledger Live*), including repeated fake password prompts as a fallback. Separately, other credential-theft campaigns are also leaning heavily on lures that exploit user trust and routine workflows. Morphisec described **Noodlophile** evolving from fake AI video platform ads to **fake job postings** and phishing “assessments,” delivering multi-stage stealers/RATs via techniques including **DLL sideloading**, while continuing to use **Telegram bots** for exfiltration/C2 and adding file-bloating content intended to disrupt automated analysis. These developments reinforce that user-in-the-loop execution (copy/paste commands, “verification” steps, and recruitment-themed forms) remains a high-yield initial access vector for stealers across both Windows and macOS environments.
Jun 29, 2026
A **ClickFix** social-engineering campaign is targeting macOS users with fake CAPTCHA or verification prompts that instruct victims to copy and paste commands into **Terminal**. The pasted command downloads a malicious `.dmg`, mounts it invisibly, and launches an app or installer that deploys **Atomic macOS Stealer** (`AMOS`). The activity relies on user manipulation rather than a software vulnerability, marking an expansion of ClickFix-style lures onto Apple systems. Once installed, `AMOS` steals browser credentials, cookies, payment data, files, Apple ecosystem data, messaging-app content, and cryptocurrency wallet information from targets including **Safari**, **Apple Notes**, **Apple Keychain**, **Telegram**, **Discord**, and wallet-related browser extensions. Reports say the malware can also show a fake macOS authentication prompt to gain elevated access, archive stolen data into a ZIP file, and exfiltrate it to attacker-controlled servers; in some cases it also replaces legitimate **Ledger Wallet** and **Trezor Suite** applications with trojanized versions to enable further theft.
Jul 30, 2026
Researchers reported a new macOS infostealer dubbed **ClickLock Stealer** that tricks users into pasting a malicious `bash` command into Terminal through ClickFix-style pages masquerading as Cloudflare verification prompts. Group-IB said the malware has been active since at least late May and has targeted at least 100 users in 33 countries, with more than half of victims in Europe. Once launched, the malware downloads multiple payloads for browser credential theft, cryptocurrency wallet theft, Keychain theft, password manager and FileZilla credential collection, shell history harvesting, and backdoor installation, then exfiltrates the stolen data to a Telegram bot. Researchers also linked the campaign to LaunchAgent persistence and a backdoor called **goyim** derived largely from GSocket tooling. ClickLock does not rely on a software exploit or privilege escalation; instead, it abuses user execution and suppresses defenses by repeatedly killing visible applications and `NotificationCenter`, sometimes every 210 milliseconds, until victims enter their macOS password and approve Keychain access. Apple separately published guidance warning that scammers increasingly use websites, chat agents, messaging platforms, and email to socially engineer Mac users into pasting unsafe Terminal commands, and said macOS may warn or block commands and scripts associated with known malware. Apple said such alerts mean the Mac has not yet been harmed and advised users not to run untrusted commands or scripts unless they fully trust the source.
Aug 11, 2026