New macOS Infinity Stealer uses Nuitka Python payload and ClickFix

The article discusses a new macOS malware called Infinity Stealer, identified by Malwarebytes. It uses a Nuitka-compiled Python payload and spreads through a deceptive fake Cloudflare CAPTCHA, tricking users into executing malicious Terminal commands. Once executed, the malware installs a Bash dropper that leads to the final payload, a Python stealer designed to collect sensitive information like browser credentials and crypto wallets.

The stealer employs techniques to avoid detection and communicates data exfiltration via Telegram. Recommendations for users include ceasing sensitive activities, changing passwords, and scanning devices for malware.