Malware & Tooling · Credential Theft

Cloudflare-Themed Lures Install Python Infostealer on macOS

Attackers used Cloudflare-themed fake verification pages to trick macOS users into pasting Terminal commands. The commands fetch and run a Nuitka-compiled Python loader that unpacks an infostealer. The stealer targets browser credentials, macOS Keychain items, cryptocurrency wallets, developer secrets, and screenshots and exfiltrates data to attacker servers.

2 sources · Mar 28

Timeline

• Mar 28 Reported by BleepingComputer

Sources

• Mar 28 BleepingComputer

  New Infinity Stealer malware grabs macOS data via ClickFix lures

  A new info-stealing malware named Infinity Stealer is targeting macOS systems with a Python payload packaged as an executable using the open-source Nuitka compiler.

  original

• Mar 28 SecurityWeek

  Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs

  The infection chain includes a fake CAPTCHA page, a Bash script, a Nuitka loader, and the Python-based infostealer.

  original

Part of the PlainSec briefing for 2026-03-28

Every edition of this story: Cloudflare-Themed Lures Install Python Infostealer on macOS

More from today

• Coruna Exploit Kit Recycles Triangulation iOS Zero‑Days