Cloudflare-Themed Lures Install Python Infostealer on macOS
Fake Cloudflare verification pages trick macOS users into running Terminal commands that install a Nuitka-compiled Python infostealer. The malware harvests browser credentials, Keychain items, cryptocurrency wallets, developer secrets and screenshots, then exfiltrates data to a C2 and notifies operators via Telegram.