Infiniti Stealer: a new macOS infostealer using ClickFix and Python/Nuitka
2026-03-26T20:51:59Z•2ea9d98d2079ee285907e3a39366450567008f5074b9f9c0441e891822a868cc
CVE-2026-20643ClickFixDarkSwordFriendlyDealerGlassWormInfinitiNuitkaNukeChainPureHVNCPythonSignalWebKitWhatsAppaccount takeoverbrowser extensionfake CAPTCHAfake app storesfake shopsiOSinfostealermacOSphishingsocial engineeringsupply chainsurveillance
What happened
Malwarebytes highlights multiple active threats and trends: a new macOS infostealer dubbed Infiniti (formerly NukeChain) uses fake CAPTCHA pages, ClickFix, and Python/Nuitka wrappers to trick users into executing malicious commands; GlassWorm installs fake browser extensions (hidden in developer tools) to surveil victims and propagate across supply chains; FBI and CISA warn of large-scale social‑engineering campaigns hijacking Signal and WhatsApp accounts; PureHVNC is being distributed via malicious Google Forms job offers; researchers document state‑level DarkSword exploit chains against un‑/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- malwarebytes_labs
- Record identifier
- 2ea9d98d2079ee285907e3a39366450567008f5074b9f9c0441e891822a868cc
- Enrichment time
- 2026-03-26T20:51:59Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.