Infiniti Stealer: a new macOS infostealer using ClickFix and Python/Nuitka

A newly documented macOS infostealer named Infiniti Stealer (initially tracked as NukeChain) uses a ClickFix fake CAPTCHA page to trick users into running a bash installer; the multi-stage attack drops a Nuitka-compiled Python stealer that collects browser credentials, Keychain entries, crypto wallets, developer secrets and screenshots, exfiltrating data via HTTP and notifying operators over Telegram. The report includes stage-by-stage analysis, IOCs (hashes, C2 domains/URLs, temp paths, packer magic), sandbox-evasion checks, and recommended remediation steps.