MalwarePublished 28 Mar 2026

Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs

Source SecurityWeek

Description

The infection chain includes a fake CAPTCHA page, a Bash script, a Nuitka loader, and the Python-based infostealer. The post Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs appeared first on SecurityWeek .

Impact

This threat poses a significant risk to organizations and individuals using macOS systems by potentially compromising sensitive information such as credentials, personal data, and browser histories. The stolen data can lead to further attacks, including account takeovers, financial fraud, and corporate espionage. While the attack does not appear to cause direct system damage or availability loss, the confidentiality breach can have severe consequences, especially for enterprises handling sensitive or regulated data. The reliance on social engineering means that user awareness is a critical factor in the attack's success, but once compromised, the attacker gains persistent access to valuable data. The multi-stage nature of the attack complicates detection and response, increasing dwell time and potential damage. Organizations with remote or mobile Mac users are particularly vulnerable. The absence of known exploits in the wild suggests the threat is emerging, but it could escalate rapidly if adopted by widespread threat actors.

Defensive guidance

To mitigate this threat, organizations should implement strict execution policies on macOS endpoints to prevent unauthorized Bash script execution, such as using macOS Gatekeeper and restricting terminal access. Deploy endpoint detection and response (EDR) solutions capable of identifying suspicious script behavior and Nuitka-compiled binaries. Educate users to recognize fake CAPTCHA pages and avoid executing scripts from untrusted sources or links, emphasizing the risks of social engineering. Employ network-level protections to block access to known malicious domains and monitor DNS queries for suspicious activity related to the attack infrastructure. Regularly update macOS and security software to leverage the latest protections. Consider application whitelisting to prevent unauthorized code execution. Incident response teams should be prepared to analyze multi-stage infection chains and remove persistent loaders. Finally, monitor threat intelligence feeds for updates on this attack and related indicators of compromise to enable proactive defense.

References

securityweek.com/cloudflare-themed-clickfix-attack-drops-infiniti-stealer-on-macs/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 28 Mar 2026, 10:36 UTC

References

Community reviews

Related threats