Fake Cloudflare CAPTCHA Pages Deliver Infiniti Stealer Malware on macOS

A newly discovered macOS infostealer dubbed Infiniti Stealer is being actively distributed through deceptive Cloudflare-style CAPTCHA pages, marking a notable evolution in social engineering attacks targeting Apple users.

Initially tracked as “NukeChain” during threat hunting efforts, the malware’s true identity was confirmed after its operator panel became publicly accessible.

Unlike traditional malware campaigns that rely on software vulnerabilities, Infiniti Stealer uses a technique known as ClickFix .

This method tricks users into executing malicious commands themselves, effectively bypassing many conventional security defenses.

The command retrieves a remote script using a base64-encoded URL. Once executed, it silently initiates the infection chain.

Because the user manually runs the command, the activity appears legitimate to the operating system, avoiding detection mechanisms that typically flag unauthorized downloads or exploits.

According to the report , attack begins with a fake verification page hosted on domains such as update-check[.]com. The page mimics a legitimate Cloudflare CAPTCHA and instructs users to verify their identity by opening Terminal and pasting a command.

This technique, previously popular on Windows systems, is now being adapted for macOS with platform-specific instructions like using Command + Space to launch Terminal.

The malware operates in three distinct stages, each designed to evade detection and complicate analysis.

Stage 1: Bash Dropper

The initial payload is a Bash script resembling templates used in earlier macOS threats such as MacSync.

It decodes an embedded payload, writes a secondary binary to the /tmp directory, removes Apple’s quarantine flag using xattr, and executes the file in the background via nohup.

It also passes command-and-control (C2) details as environment variables before deleting itself and closing the Terminal window.

Stage 2: Nuitka Loader

The second stage is a compiled Mach-O binary (~8.6 MB) built using Nuitka in onefile mode. Unlike PyInstaller, Nuitka converts Python code into C, producing a native executable that is significantly harder to reverse engineer.

The binary contains a “KAY” header and decompresses approximately 35 MB of embedded data at runtime before launching the final payload.

Stage 3: Python Stealer Payload

The final component, identified as UpdateHelper[.]bin, is a Python 3.11-based infostealer. Despite compilation, analysts can reconstruct its structure due to exposed symbols.

The malware targets a wide range of sensitive data, including browser credentials, macOS Keychain entries, cryptocurrency wallets, and developer secrets stored in .env files. It also captures screenshots during execution.

Collected data is exfiltrated via HTTP POST requests. Before initiating theft, the malware checks for analysis environments such as Any.Run, Joe Sandbox, Hybrid Analysis, VMware, and VirtualBox, and introduces randomized delays to evade automated detection.

Once complete, it notifies the operator via Telegram and queues stolen credentials for further exploitation.

Infiniti Stealer highlights a shift in attacker focus toward macOS systems , challenging the long-standing perception that Apple devices are less susceptible to malware.

Users who may have interacted with such fake CAPTCHA pages should take immediate action:

This campaign reinforces a critical security principle: no legitimate CAPTCHA or website will ever require users to paste commands into Terminal.

Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.

The Internet Systems Consortium (ISC) has released critical security advisories addressing three new vulnerabilities in…

The Cybersecurity and Infrastructure Security Agency (CISA) has urgently added a critical flaw affecting Aquasecurity’s…

A threat actor known as Silver Fox is targeting Japanese organizations with a new wave…

The FBI Cyber Division has issued a critical alert following a massive supply chain attack…

A South Asian financial institution has been hit by a custom malware toolkit combining a…

Red Hat has issued an urgent security alert regarding a highly sophisticated supply chain attack…