GoPlus Security 🚦 (@GoPlusSecurity): 🚨 GoPlus Security Alert: Infiniti Stealer targets Mac users’ crypto wallets

🚨 GoPlus Security Alert: Infiniti Stealer targets Mac users’ crypto wallets Infiniti Stealer leverages a “ClickFix” social engineering attack to trick users into installing malicious code, silently exfiltrating crypto wallets, sensitive credentials, and digital assets. 🔍 Attack Chain Breakdown: 1️⃣ ClickFix lure: Attackers spoof a highly convincing Cloudflare CAPTCHA page, prompting users to open Terminal and manually paste & execute malicious commands. 2️⃣ Bash dropper: Once executed, the command fetches a Stage-1 script that removes macOS quarantine attributes (http://com.apple/.quarantine), writes the Stage-2 payload into /tmp, and runs it silently in the background. 3️⃣ Nuitka evasion: The final payload is a Python stealer compiled via Nuitka into a native macOS binary, significantly increasing detection difficulty for security tools and analysts. ☠️ Impact & Stealth Capabilities: Once deployed, Infiniti Stealer covertly harvests: 🔑 Chromium / Firefox credentials + macOS Keychain 💰 Crypto wallets 📁 Developer secrets (e.g. .env files) It also features sandbox detection and delayed execution for enhanced stealth. 🛡️ #Goplus Security Best Practices: 1️⃣ Follow the #GoPlus anti-phishing “4 Don’ts”: Don’t click, don’t install, don’t sign, don’t transfer • Don’t click unknown links • Don’t install unverified software • Don’t sign suspicious wallet transactions • Don’t send funds to unverified addresses 2️⃣ Immediate containment: If compromise is suspected, stop using the device for sensitive activities (banking, work, wallet ops). 3️⃣ Credential reset: On a clean device, rotate critical passwords immediately and revoke active API tokens, SSH keys, and login sessions. 4️⃣ System inspection: Check for suspicious persistence files in /tmp and ~/Library/LaunchAgents/, and run a full antivirus scan (e.g. AVG). More details: https://malwarebytes.com/blog/threat-intel/2026/03/infiniti-stealer-a-new-macos-infostealer-using-clickfix-and-python-nuitka