{"id":11654,"date":"2026-03-27T10:03:48","date_gmt":"2026-03-27T10:03:48","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/03\/27\/fake-cloudflare-captcha-pages-spread-infiniti-stealer-malware-on-macos-systems\/"},"modified":"2026-03-27T10:03:48","modified_gmt":"2026-03-27T10:03:48","slug":"fake-cloudflare-captcha-pages-spread-infiniti-stealer-malware-on-macos-systems","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/03\/27\/fake-cloudflare-captcha-pages-spread-infiniti-stealer-malware-on-macos-systems\/","title":{"rendered":"Fake Cloudflare CAPTCHA Pages Spread Infiniti Stealer Malware on macOS Systems"},"content":{"rendered":"

Fake Cloudflare CAPTCHA Pages Spread Infiniti Stealer Malware on macOS Systems
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A new macOS malware that was undocumented previously, is quietly tricking users through fake Cloudflare human verification pages.<\/p>\n

Called Infiniti Stealer, this threat uses a well-known social engineering trick called ClickFix to convince Mac users into running dangerous commands directly on their own machines, bypassing the need for any software vulnerability or exploit.<\/a><\/p>\n

For a long time, many Mac users have believed their systems are naturally resistant to malware. Infiniti Stealer challenges that assumption directly. The malware was originally tracked under the internal name NukeChain during routine threat hunting. <\/p>\n

Just before its public disclosure, the threat actor\u2019s operator control panel accidentally became visible online, revealing the malware\u2019s true name and confirming that this is a structured, ongoing campaign aimed directly at macOS users.<\/a><\/p>\n

Malwarebytes analysts identified Infiniti Stealer<\/a> as the first documented macOS campaign to combine ClickFix delivery with a Nuitka-compiled Python stealer. <\/p>\n

The attack begins at a malicious domain, update-check[.]com, which hosts a near-perfect replica of a Cloudflare human verification page. <\/p>\n

\n
\"Fake
Fake Cloudflare CAPTCHA Page (Source \u2013 Malwarebytes)<\/figcaption><\/figure>\n<\/div>\n

Visitors on the fake page are instructed to open Terminal, paste a provided command, and press Return. What appears to be a routine identity check immediately triggers the entire infection chain.<\/a><\/p>\n

What makes this attack especially dangerous is that it does not rely on any software flaw. There is no malicious file to download, no phishing attachment, and no drive-by exploit. <\/p>\n

The attacker depends entirely on the user trusting the fake CAPTCHA<\/a>. Once the command is run, the malware\u2019s payload executes silently in the background, leaving no obvious sign that anything has gone wrong.<\/a><\/p>\n

The damage potential of Infiniti Stealer is serious and far-reaching. The malware is built to harvest login credentials from Chromium-based browsers and Firefox, collect macOS Keychain entries, drain cryptocurrency wallets<\/a>, take screenshots during execution, and pull plaintext secrets from developer environment files such as\u00a0.env<\/code>. <\/p>\n

All collected data is sent to a remote server via HTTP POST requests, and the operator receives an immediate Telegram notification once the upload is complete.<\/a><\/p>\n

Three-Stage Infection Chain<\/strong><\/h2>\n

Once the victim runs the Terminal command, Infiniti Stealer works through three separate stages to complete the compromise. The first is a Bash dropper script that uses a template also found in earlier macOS stealers<\/a> like MacSync, suggesting the use of a shared malware builder. <\/p>\n

\n
\"Stage
Stage 1 Bash Dropper Script (Source \u2013 Malwarebytes)<\/figcaption><\/figure>\n<\/div>\n

The script decodes an embedded payload, writes the next stage binary to the\u00a0\/tmp<\/code>\u00a0folder, strips the macOS quarantine attribute, and runs the file silently using\u00a0nohup<\/code>. <\/p>\n

It then deletes itself and closes Terminal via AppleScript, ensuring the victim sees nothing unusual.<\/a><\/p>\n

The second stage delivers an Apple Silicon Mach-O binary of around 8.6 MB, built using Nuitka\u2019s onefile mode. <\/p>\n

\n
\"Stage
Stage 2 Nuitka Loader Binary (Source \u2013 Malwarebytes)<\/figcaption><\/figure>\n<\/div>\n

Unlike PyInstaller, Nuitka compiles Python source code into C and produces a native binary, making static analysis significantly harder for security tools<\/a>. At runtime, this loader decompresses around 35 MB of embedded data and hands off execution to the final payload.<\/a><\/p>\n

The third stage,\u00a0UpdateHelper[.]bin<\/code> is a Python 3.11 stealer also compiled with Nuitka. <\/p>\n

Before stealing any data, it checks whether it is running inside known analysis environments including any.run, Joe Sandbox, Hybrid Analysis, VMware, or VirtualBox. <\/p>\n

It also adds a randomized execution delay to avoid triggering automated detection systems.<\/a><\/p>\n

If you suspect you may have been affected, take these steps immediately:<\/a><\/p>\n