New Infinity Stealer malware grabs macOS data via ClickFix lures

Multiple active campaigns and supply‑chain incidents were reported: Infinity Stealer (macOS info‑stealer) uses a Python/Nuitka executable and ClickFix lures to harvest data; a Telnyx PyPI package was backdoored (TeamPCP) to deliver credential‑stealing malware hidden in a WAV file; fake VS Code security alerts on GitHub are being used to trick developers into downloading malware. Separately, CISA warned of active exploitation of a critical Langflow vulnerability (CVE-2026-33017) that can hijack AI workflows, while the European Commission is investigating an Amazon cloud account breach. Other IO