# Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs
## A Sophisticated Social Engineering Chain Targets macOS Users with Fake CAPTCHA Pages
A newly identified attack campaign is leveraging the ClickFix social engineering technique — disguised as a Cloudflare CAPTCHA verification page — to deliver the Infiniti Stealer, a Python-based infostealer targeting macOS systems. The multi-stage infection chain moves from a convincing fake verification prompt through a Bash script and Nuitka-compiled loader before deploying its final payload, marking yet another escalation in threats aimed squarely at Apple's desktop platform.
The campaign underscores an uncomfortable reality for defenders: macOS, long perceived as a safer alternative to Windows, is firmly in the crosshairs of commodity and bespoke malware operators alike.
## Background and Context
ClickFix is a social engineering technique that has gained significant traction among threat actors since its emergence in 2024. The approach typically involves presenting victims with a fake error message, CAPTCHA, or verification prompt on a website, then instructing them to "fix" the issue by copying and pasting a command into their terminal or Run dialog. What makes ClickFix particularly effective is that it shifts the execution burden onto the user — bypassing traditional browser-based exploit mitigations entirely.
Previous ClickFix campaigns have impersonated Google reCAPTCHA pages, Microsoft authentication prompts, and various SaaS login screens. This latest variant co-opts the Cloudflare Turnstile verification page — a ubiquitous sight across the modern web — lending the lure an immediate sense of legitimacy. Users encountering a Cloudflare challenge page have been conditioned to comply with verification steps, making this an ideal social engineering vector.
The targeting of macOS is a deliberate strategic choice. As enterprise adoption of Apple hardware continues to grow — particularly among executives, developers, and creative professionals — the value of credentials and data stored on these machines has made them high-priority targets. The perception that Macs are inherently more secure also means users may be less suspicious of unusual prompts and organizations may deploy fewer endpoint protections on macOS devices.
## Technical Details
The infection chain observed in this campaign is a carefully orchestrated multi-stage process designed to evade detection at each step.
Stage 1: The Fake CAPTCHA Lure. Victims are directed to a malicious webpage — typically through phishing emails, malvertising, or compromised websites — that presents a pixel-perfect replica of a Cloudflare Turnstile CAPTCHA page. The page instructs the user to complete a "verification step" by opening their macOS Terminal and pasting a provided command. The social engineering copy is polished, using language consistent with legitimate Cloudflare challenges and warning that the verification is necessary to "prove you are human."
Stage 2: Bash Script Execution. The command copied by the victim executes a Bash script that serves as the initial foothold. This script handles reconnaissance of the target system, checks for virtualization or analysis environments, and downloads the next-stage payload. By using a native Bash script rather than a compiled binary for this initial stage, the attackers minimize the chances of triggering signature-based detections — Bash commands blending in with normal system administration activity.
Stage 3: The Nuitka Loader. The second stage deploys a loader compiled with Nuitka, a Python-to-native compiler that converts Python code into standalone executables. This is a notable technical choice. Nuitka-compiled binaries are significantly harder to reverse-engineer than standard Python scripts or PyInstaller bundles because the Python bytecode is translated into optimized C code before compilation. This compilation step effectively obfuscates the loader's logic, complicating both static and dynamic analysis efforts by security researchers. The loader handles persistence mechanisms, additional environment checks, and the decryption and deployment of the final payload.
Stage 4: Infiniti Stealer Deployment. The final payload is the Infiniti Stealer, a Python-based infostealer with comprehensive data exfiltration capabilities. While specific technical reporting on this stealer's full feature set is still emerging, infostealers in this class typically target browser-stored credentials and cookies (Safari, Chrome, Firefox, Brave), cryptocurrency wallet data and seed phrases, keychain entries and stored passwords, system information and installed application inventories, documents and files matching targeted extensions, messaging application data, and authentication tokens for cloud services.
The stolen data is typically exfiltrated to attacker-controlled infrastructure, often over encrypted channels or through legitimate services like Telegram bots or Discord webhooks to blend with normal traffic.
## Real-World Impact
The implications of this campaign extend well beyond individual users. macOS devices are disproportionately represented in executive suites, development teams, and creative departments — precisely the users most likely to have access to sensitive corporate resources, source code repositories, and privileged credentials.
A successful Infiniti Stealer infection on a single developer's machine could yield SSH keys, API tokens, cloud console credentials, and access to CI/CD pipelines. On an executive's laptop, it could expose strategic communications, financial data, and board-level documents. Browser session cookies alone can enable attackers to bypass multi-factor authentication entirely, hijacking active sessions to corporate SaaS platforms.
For organizations, the downstream consequences include potential supply chain compromises, unauthorized access to cloud infrastructure, business email compromise, and data breaches — all stemming from what the victim perceived as a routine CAPTCHA interaction.
## Threat Actor Context
The specific threat actor or group behind this campaign has not been definitively attributed at this time. However, ClickFix-based attack chains have been adopted across a broad spectrum of operators — from financially motivated cybercrime groups to state-aligned advanced persistent threat actors.
The commoditization of ClickFix kits on underground forums has lowered the barrier to entry, enabling less sophisticated operators to deploy convincing lures. The use of Nuitka compilation and the development of a macOS-specific stealer, however, suggest a degree of technical sophistication and investment that goes beyond entry-level cybercrime. Groups known for deploying infostealers — including operators behind Atomic Stealer, Poseidon Stealer, and similar macOS-targeting malware — represent likely candidates, though definitive attribution awaits further analysis.
The broader trend is clear: the macOS infostealer ecosystem has matured rapidly, with malware-as-a-service offerings making purpose-built Mac malware accessible to a wide range of threat actors.
## Defensive Recommendations
Organizations and individual users should take the following steps to mitigate the risk posed by this and similar campaigns:
User Awareness Training. Educate users specifically about the ClickFix technique. Employees should understand that no legitimate website will ever ask them to open a terminal and paste commands. This specific scenario should be incorporated into phishing simulation programs.
Endpoint Protection. Deploy macOS-capable endpoint detection and response (EDR) solutions. Ensure that macOS endpoints receive the same level of security tooling and monitoring as Windows machines. Many organizations still have a coverage gap on Apple devices.
Terminal Monitoring. Monitor for unusual Terminal or shell activity on macOS endpoints, particularly command execution patterns that involve downloading and executing remote scripts — the hallmark curl | bash pattern and its variants.
Browser Security. Consider deploying browser isolation or management solutions that can detect and block fake CAPTCHA pages. Web filtering that flags newly registered or low-reputation domains hosting Cloudflare-themed content can provide an early warning layer.
Credential Hygiene. Implement short-lived credentials and session tokens where possible. Regularly rotate API keys and access tokens. Use hardware security keys for MFA to limit the impact of stolen session cookies.
Network Monitoring. Watch for anomalous outbound data transfers from macOS endpoints, particularly to Telegram API endpoints, Discord webhook URLs, or unfamiliar external infrastructure.
## Industry Response
The security community has increasingly sounded the alarm on the convergence of social engineering innovation and macOS-targeted malware. Apple's own security team has continued to strengthen Gatekeeper, XProtect, and notarization requirements with each macOS release, but these protections are inherently limited against attacks that rely on the user voluntarily executing commands.
Security vendors have been expanding their macOS detection capabilities, with several major EDR platforms releasing updated behavioral detection rules targeting ClickFix execution patterns — specifically the sequence of clipboard manipulation followed by terminal execution of downloaded scripts. Threat intelligence teams across the industry are actively tracking the proliferation of ClickFix kits and the growing roster of macOS infostealers they deliver.
The message from researchers is consistent: organizations can no longer afford to treat macOS as a low-risk platform. The threat landscape has evolved, and defensive strategies must evolve with it.
---