New Infinity Stealer malware grabs macOS data via ClickFix lures

A cluster of active security incidents and supply-chain attacks was reported: a new macOS info‑stealer dubbed Infinity Stealer (Python payload compiled with Nuitka) is being distributed via ClickFix lures; the Telnyx PyPI package was backdoored (attributed to TeamPCP) to deliver credential‑stealing malware hidden inside a WAV file; and a large campaign is spreading malware to developers via fake VS Code security alerts posted in GitHub Discussions. CISA warned that a critical Langflow flaw (CVE-2026-33017) is being actively exploited to hijack AI workflows. Separately, the European Commission,