Cloudflare-Themed ClickFix Campaign Delivers Infiniti Stealer to macOS Users
Summary
Malwarebytes reports a macOS ClickFix campaign that uses a fake Cloudflare verification page to trick users into running a command that installs Infiniti Stealer, which targets credentials, Keychain data, crypto wallets, developer secrets, and screenshots.
Key points
- A fake CAPTCHA page presents a Cloudflare-themed verification prompt instructing macOS users to paste and run a command in Terminal.
- The command fetches a Bash script that decodes an embedded payload, writes a second-stage binary to a temporary folder, removes its quarantine flag, and executes it.
- The Nuitka-compiled loader decompresses embedded data and launches Infiniti Stealer, a Python-based information stealer.
- The stealer targets browser credentials, Keychain information, cryptocurrency wallets, developer-file secrets, and screenshots.
- Collected data is sent to a command-and-control server over HTTP POST; the malware also notifies a Telegram channel and queues captured credentials for cracking.
- Infiniti Stealer uses randomized execution delays and checks for known analysis environments to evade detection.
Article Details
- Attack Vectors
- A fake CAPTCHA and Cloudflare-themed verification page uses ClickFix social engineering to persuade macOS users to paste and execute a command in Terminal.
- The command fetches a Bash script from a remote server. The script decodes an embedded payload, writes a second-stage binary to a temporary folder, removes its quarantine flag, and executes it.
- A Nuitka-compiled loader decompresses embedded data and launches Infiniti Stealer, which collects browser credentials, Keychain information, cryptocurrency wallets, secrets in developer files, and screenshots.
- Infiniti Stealer sends collected data to its C&C server over HTTP POST and sends an operation notification to a Telegram channel.
- Defensive Notes
- Treat verification pages that ask users to paste and execute commands in Terminal as suspicious.
MITRE ATT&CK
T1005 · Data from Local SystemThe stealer targets secrets stored in developer files on the infected system.T1041 · Exfiltration Over C2 ChannelThe malware sends stolen information to its C&C server over HTTP POST.T1059.004 · Unix ShellA pasted command triggers a Bash script, which downloads and runs the next stage.T1071.001 · Web ProtocolsInfiniti Stealer sends collected data to its C&C server using HTTP POST requests.T1105 · Ingress Tool TransferThe command fetches a Bash script from a remote server.T1113 · Screen CaptureThe stealer collects screenshots captured during execution.T1140 · Deobfuscate/Decode Files or InformationThe Bash script decodes an embedded payload, and the loader decompresses embedded data before launching Infiniti Stealer.T1204.004 · Malicious Copy and PasteThe fake verification page tricks macOS users into copying and executing a command in Terminal.T1497.001 · System ChecksInfiniti Stealer checks whether the system is a known analysis environment.T1497.003 · Time Based ChecksInfiniti Stealer uses a randomized execution delay.T1553.001 · Gatekeeper BypassThe script removes the downloaded binary's quarantine flag before executing it.T1555.001 · KeychainInfiniti Stealer targets Keychain information.T1555.003 · Credentials from Web BrowsersInfiniti Stealer targets browser credentials.