Cloudflare-Themed Lures Install Python Infostealer on macOS

Fake Cloudflare verification pages trick macOS users into running Terminal commands that install a Nuitka-compiled Python infostealer. The malware harvests browser credentials, Keychain items, cryptocurrency wallets, developer secrets and screenshots, then exfiltrates data to a C2 and notifies operators via Telegram.

Part of the PlainSec briefing for 2026-03-29

Sources