New Infinity Stealer malware grabs macOS data via ClickFix lures

Multiple active security incidents and campaigns: a new Infinity Stealer targets macOS with a Nuitka-packaged Python info‑stealer using ClickFix lures; the Telnyx PyPI package was backdoored to deliver credential‑stealing malware hidden in a WAV file (supply‑chain compromise); GitHub Discussions are being abused with fake VS Code security alerts to spread malware to developers; CISA warns of active exploitation of a critical Langflow vulnerability (CVE-2026-33017) that can hijack AI workflows. Additional notable incidents include a breach of an Amazon cloud account affecting the European Commm