Infiniti Stealer Uses ClickFix to Deliver a Nuitka-Compiled macOS Infostealer
Summary
Malwarebytes reports that Infiniti Stealer uses a fake verification page and ClickFix to deliver a staged macOS stealer. The malware harvests credentials and other sensitive data, then exfiltrates it over HTTP.
Key points
- The researchers say they tracked the previously undocumented malware as NukeChain before identifying it as Infiniti Stealer through its operator panel.
- A fake Cloudflare verification page on update-check[.]com prompts users to paste a command into Terminal, launching the infection without exploiting a software vulnerability.
- A Bash dropper writes a Stage 2 binary to /tmp, removes macOS quarantine flags with xattr, launches the binary, and deletes itself.
- The Apple Silicon loader uses Nuitka onefile packaging to unpack and launch a Python 3.11 stealer.
- The stealer targets Chromium and Firefox credentials, macOS Keychain entries, cryptocurrency wallets, developer secrets in .env files, and screenshots; it exfiltrates data via HTTP POST.
- The malware checks for analysis environments, adds randomized delays, and sends an operator notification via Telegram after uploads complete.
- The article recommends changing passwords from a clean device, revoking sessions and keys, checking for suspicious files, and scanning the affected Mac.
Article Details
- Attack Vectors
- A fake Cloudflare verification page on update-check[.]com uses ClickFix social engineering to persuade users to paste and run a Terminal command.
- The command fetches and runs a Bash dropper, which decodes and writes a Stage-2 binary to /tmp, removes its quarantine flag, launches it, and deletes itself.
- A Nuitka-compiled loader unpacks and launches a Python 3.11 stealer that collects browser credentials, macOS Keychain entries, cryptocurrency wallets, plaintext developer secrets, and screenshots.
- The stealer exfiltrates collected data through HTTP POST requests and sends the operator a Telegram notification when upload completes.
- Defensive Notes
- Do not paste commands into Terminal from websites; the article notes that legitimate CAPTCHA verification does not require this.
- If affected, stop using the device for sensitive activity, change passwords from a clean device, revoke active sessions and API tokens or SSH keys, check /tmp and ~/Library/LaunchAgents/, and run a full Malwarebytes scan.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | infiniti-stealer[.]com | Domain of the Infiniti Stealer operator panel, which the article says became publicly visible. |
| DOMAIN | update-check[.]com | Malicious delivery and staging domain serving the fake verification page and first-stage dropper. |
| MD5 | da73e42d1f9746065f061a6e85e28f0c | MD5 hash identified in the article as the Infiniti Stealer dropper binary. |
| SHA256 | 1e63be724bf651bb17bcf181d11bacfabef6a6360dcdfda945d6389e80f2b958 | SHA-256 hash identified in the article as the Stage-3 Nuitka-compiled stealer. |
| URL | hxxps[:]//update-check[.]com/m/7d8df27d95d9 | Specific first-stage dropper resource on the malicious delivery domain. |
MITRE ATT&CK
T1005 · Data from Local SystemThe stealer collects local browser credentials, Keychain entries, cryptocurrency wallets, developer secrets, and screenshots.T1041 · Exfiltration Over C2 ChannelThe malware exfiltrates collected data to the operator using HTTP POST requests.T1059.004 · Unix ShellA Bash dropper decodes the payload, writes a binary to /tmp, and launches it with nohup.T1105 · Ingress Tool TransferThe pasted Bash command uses curl to fetch the first-stage dropper from update-check[.]com.T1113 · Screen CaptureThe stealer captures screenshots during execution.T1204.004 · Malicious Copy and PasteThe ClickFix page tricks users into copying and pasting a command into Terminal and running it.T1497.001 · System ChecksThe malware checks for analysis environments including any.run, Joe Sandbox, Hybrid Analysis, VMware, and VirtualBox.T1497.003 · Time Based ChecksThe malware introduces a randomized execution delay to evade automated analysis.T1552.001 · Credentials In FilesThe stealer searches developer files such as .env for plaintext secrets.T1553.001 · Gatekeeper BypassThe dropper uses xattr to remove the macOS quarantine attribute from the staged binary.T1555.001 · KeychainThe stealer harvests macOS Keychain entries.T1555.003 · Credentials from Web BrowsersThe stealer collects credentials from Chromium-based browsers and Firefox.
People
Malware
Infiniti StealerInfiniti Stealer is a previously undocumented macOS infostealer delivered via a ClickFix socialâengineering scheme that tricks users into pasting a Terminal command to fetch a Bash dropper and ultimately runs aNukeChainWe initially tracked it as NukeChain, but shortly before publication, the malware’s operator panel became publicly visible, revealing its real name: Infiniti Stealer.
Vendors
Products
macOSInfiniti Stealer is a previously undocumented macOS infostealer delivered via a ClickFix socialâengineering scheme that tricks users into pasting a Terminal command to fetch a Bash dropper and ultimately runs aTelegramand exfiltrates data via HTTP POST while performing sandbox checks and notifying the operator via Telegram.