A previously undocumented macOS infostealer has surfaced during our routine threat hunting. Malwarebytes Labs researchers initially tracked it as NukeChain, but shortly before publication, the malware’s operator panel became publicly visible, revealing its real name: Infiniti Stealer.
This malware is designed to steal sensitive data from Macs. It spreads through a fake CAPTCHA page that tricks users into running a command themselves: a technique known as ClickFix. Instead of exploiting a bug, it relies on social engineering. The final payload is written in Python and compiled with Nuitka, producing a native macOS binary. That makes it harder to analyze and detect than typical Python-based malware. To our knowledge, this is the first documented macOS campaign combining ClickFix delivery with a Nuitka-compiled Python stealer.
Read more…
Source: Malwarebytes Labs
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- No company too small for Phobos ransomware gang, indictment reveals
December 2, 2024
The US Department of Justice has charged a Russian national named Evgenii Ptitsyn with selling, operating, and distributing a ransomware variant known as “Phobos” during a four-year cybercriminal campaign that extorted at least $16 million from victims across the world. The government’s indictment against Ptitsyn should dispel any notion that ransomware gangs only target the largest, ...
- RansomHub claims to net data hat-trick against Bologna FC
November 30, 2024
Italian professional football club Bologna FC is allegedly a recent victim of the RansomHub cybercrime gang, according to the group’s dark web postings. The ransomware crims responsible for attacks on organizations including Planned Parenthood and Christie’s – the same crew thought to have picked up LockBit’s top talent post-disruption – posted an extensive collection of data ...
- Some London commuters may never be refunded after TfL cyber attack
November 30, 2024
Sadiq Khan has admitted victims of a Transport for London (TfL) cyber attack may never get their money back. Tens of thousands of Londoners are feared to have been left out of pocket after hackers gained access to the travel authority’s systems in September. The aftermath of the hack meant over-60s, children and students were unable to ...
- Pakistan: Severe Cyber Attack at Dewan Farooque Motors Corrupts Data and Crashes Servers
November 30, 2024
A cyber-attack crippled Dewan Farooque Motors Limited (DFML), corrupting key corporate data and crashing servers. The Pakistan Stock Exchange (PSX) received notice of the incident on Friday. DFML told stakeholders that restoring its information systems and financial data, including information from the first quarter ending September 30, 2024, will be a lengthy process. Read more… Source: ProPakistan News Sign ...
- Another background check company suffered data breach with over 600,000 people details exposed
November 29, 2024
Another background check company suffered a data breach; this time, more than 600,000 people were affected. It’s a minor breach compared with the 2.9 billion people hit by the National Public Data hack, but it’s still scary. The company in question, SL Data Services, was discovered online. It was publicly exposed and not password-protected or encrypted. ...
- SonicWall Releases Security Updates for SMA100 NetExtender for Windows (CVE-2024-29014)
November 27, 2024
SonicWall has released a security update addressing a vulnerability in the Windows (32 and 64-bit) versions of SonicWall SMA100 NetExtender. SMA100 NetExtender is a virtual private network (VPN) client. This vulnerability tracked as CVE-2024-29014, may allow an attacker to execute arbitrary code when processing an EPC Client update. CVE-2024-29014 was originally assigned a CVSSv3 score of ...