Fake Cloudflare CAPTCHA Pages Spread Infiniti Stealer On macOS

Security researchers have uncovered a new macOS information stealer called Infiniti Stealer. Originally tracked under the name NukeChain, this malware aims to steal sensitive data from Mac users.

Instead of using complex software exploits, it relies on a social engineering technique known as ClickFix to trick victims into infecting their own computers.

The attack begins with a fake Cloudflare human verification page hosted on malicious websites.

This convincing fake CAPTCHA instructs users to open their Mac Terminal and paste a specific command to prove they are human.

Because the user manually executes the command, traditional security defenses like antivirus software or exploit blockers are bypassed entirely.

The Infection Process and Payload

Once the victim pastes the command into their Terminal, a three-stage infection process begins immediately.

First, a Bash dropper script downloads and decodes a hidden payload from the attacker’s server. It saves a new file to the temporary folder, removes Apple’s protective quarantine flag, and launches the next stage in the background before quickly closing the Terminal window.

The second stage is a Nuitka loader built specifically for Apple Silicon Macs. Unlike standard Python malware, Nuitka compiles Python code into a native application, which makes it much harder for security tools to analyze and detect.

This loader decompresses a massive embedded data file and triggers the final malicious stage.

The final payload is the Infiniti Stealer itself. It targets a wealth of personal data, including browser passwords, macOS Keychain entries, cryptocurrency wallets, and plain-text developer secrets. It even captures screenshots of the infected machine.

Remediation and Indicators Of Compromise

The rise of Infiniti Stealer proves that macOS is becoming a prime target for malware operators.

If you recently pasted a command into your Terminal to pass a CAPTCHA, you must assume your device is compromised. No legitimate website will ever ask you to use the Terminal to verify your identity.

If you suspect an infection, take the following steps immediately to protect your digital footprint:

• Stop using the infected Mac for any sensitive activities, such as banking or work.
• Change your passwords on a completely different device.
• Revoke access to active sessions, API tokens, and SSH keys.
• Check your system for suspicious files hidden in temporary folders or launch agents.
• Run a full scan with reputable security software to remove any lingering malware.

For security professionals and threat hunters, tracking this malware bytes requires monitoring specific technical footprints. Below are the primary Indicators of Compromise (IOCs) associated with the Infiniti Stealer campaign.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.