A novel data-stealing malware, Infinity Stealer, is targeting macOS devices. It employs a Python-based code hidden within an executable built with the Nuitka compiler.

The attack utilizes the ClickFix method, presenting a deceptive CAPTCHA resembling Cloudflare’s security check to trick users into running malicious code.

Malwarebytes researchers report that this is the first instance of a macOS attack that combines ClickFix delivery with a Python-coded information stealer compiled using Nuitka.

Because Nuitka transforms the Python script into C code to create a native binary, the resulting file is harder to analyze.

Unlike PyInstaller, which packages Python with bytecode, this method is more difficult to detect because it creates a true native binary without a readily apparent bytecode layer, which complicates reverse engineering.

“The actual malicious code is written in Python and then turned into a native macOS binary using Nuitka, making it more difficult to examine and identify than typical Python malware,” Malwarebytes states.

The attack starts with a ClickFix lure hosted on the domain update-check[.]com, masquerading as a Cloudflare human verification process and prompting the user to complete the challenge by pasting a base64-encoded curl command into the macOS Terminal, thus bypassing system security.

The executed command decodes a Bash script that writes the second-stage component (Nuitka loader) to /tmp, removes the quarantine attribute, and runs it using ‘nohup.’ Finally, it relays the command-and-control (C2) address and token via environment variables before deleting itself and closing the Terminal window.

The Nuitka loader is an 8.6 MB Mach-O file that encompasses a 35MB zstd-compressed archive. This archive contains the third-stage component (UpdateHelper.bin), the Infinity Stealer malware.

Before beginning to gather sensitive information, the malware carries out anti-analysis checks to see if it’s running in a simulated or isolated environment.

Malwarebytes’ investigation of the Python 3.11 malware revealed that it can capture screenshots and steal the following data:

• Logins from Chromium-based browsers and Firefox
• macOS Keychain information
• Cryptocurrency wallets
• Unencrypted secrets in developer files, such as .env

All stolen data is sent to the C2 server via HTTP POST requests, and a Telegram alert is sent to the attackers when the operation is done.

Malwarebytes emphasizes that the emergence of malware such as Infinity Stealer shows that threats against macOS users are becoming more sophisticated and targeted.

Users should avoid copying and pasting commands from the internet into the Terminal without understanding them.