Fake Cloudflare CAPTCHA Pages Deliver Infiniti Stealer Malware on macOS

Infiniti Stealer is an actively distributed macOS infostealer delivered through fake Cloudflare-style CAPTCHA pages that coerce users to paste and run Terminal commands (ClickFix). The campaign uses a three-stage chain—a Bash dropper, a Nuitka-compiled Mach-O loader, and a Python-based stealer—to harvest browser credentials, Keychain items, crypto wallets, developer secrets, and screenshots, exfiltrating data via HTTP and notifying operators via Telegram; the report includes hashes, domains/URLs, file paths, detection-evasion notes, and recommended remediation steps.