Malware & Tooling · Credential Theft

Cloudflare-Themed Lures Install Python Infostealer on macOS

Fake Cloudflare verification pages trick macOS users into running Terminal commands that install a Nuitka-compiled Python infostealer. The malware harvests browser credentials, Keychain items, cryptocurrency wallets, developer secrets and screenshots, then exfiltrates data to a C2 and notifies operators via Telegram.

2 sources · Mar 28

Timeline

• Mar 28 Reported by BleepingComputer

Sources

• Mar 28 BleepingComputer

  New Infinity Stealer malware grabs macOS data via ClickFix lures

  A new info-stealing malware named Infinity Stealer is targeting macOS systems with a Python payload packaged as an executable using the open-source Nuitka compiler.

  original

• Mar 28 SecurityWeek

  Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs

  The infection chain includes a fake CAPTCHA page, a Bash script, a Nuitka loader, and the Python-based infostealer.

  original

Part of the PlainSec briefing for 2026-03-29

Every edition of this story: Cloudflare-Themed Lures Install Python Infostealer on macOS

More from today

• Coruna Exploit Kit Recycles Triangulation iOS Zero‑Days