Infinity Stealer - New macOS Malware Campaign Uncovered
Basically, a new malware tricks Mac users into running harmful commands.
A new malware campaign called Infinity Stealer is targeting macOS users through fake Cloudflare CAPTCHAs. This sophisticated attack collects sensitive data, posing serious risks. Users are urged to take protective measures immediately.
What Happened
Researchers at Malwarebytes have identified a new macOS infostealer called Infinity Stealer. This malware uses a Python payload compiled with Nuitka and spreads through a method known as ClickFix. The attack begins with a fake Cloudflare CAPTCHA designed to deceive users into executing malicious commands in their Terminal. The report indicates that this is the first campaign of its kind targeting macOS, adapting techniques previously seen on Windows systems.
The fake CAPTCHA instructs users to open Terminal, paste a command, and execute it. This action initiates the infection process, which involves fetching a Stage-1 Bash dropper. The dropper decodes the payload and writes a Stage-2 binary that removes macOS protections and executes the payload. This sophisticated approach demonstrates that macOS is increasingly becoming a target for malware attacks.
Who's Being Targeted
The Infinity Stealer campaign primarily targets macOS users, capitalizing on their trust in familiar interfaces like Cloudflare. Users who encounter fake verification pages are at risk, especially if they follow the instructions without verifying their authenticity. This campaign is particularly concerning as it signifies a shift in the threat landscape, where macOS is no longer considered a low-risk environment for malware.
The malware collects sensitive information such as browser credentials, Keychain entries, and even screenshots. It also has the capability to detect analysis environments, making it more challenging for security professionals to identify and mitigate the threat. This adaptability showcases the evolving nature of cyber threats.
Signs of Infection
Indicators of infection include unexpected prompts to open Terminal and paste commands. Users may also notice unusual behavior on their devices, such as unauthorized access to sensitive information or unexpected notifications. If you suspect that you have executed suspicious commands, it is crucial to act quickly.
Malwarebytes has provided Indicators of Compromise (IOCs) for this campaign, which can help users and organizations identify potential infections. Signs of the malware's presence may include unauthorized access to accounts or unusual activity in applications like crypto wallets.
How to Protect Yourself
To safeguard against Infinity Stealer, users should take immediate action if they have run any suspicious Terminal commands. Here are some recommended steps:
- Stop all sensitive activities immediately.
- Change your passwords from a secure device.
- Revoke any active sessions and keys associated with compromised accounts.
- Check your /tmp directory and LaunchAgents for any unauthorized files.
- Run a full scan with reputable antimalware software.
Experts advise against pasting commands from websites, as legitimate CAPTCHAs do not require such actions. Staying informed about emerging threats and employing good security hygiene can significantly reduce the risk of malware infections.