Infiniti Stealer, a new malware identified by GoPlus Security, is targeting Mac users' cryptocurrency wallets and sensitive credentials. The malware employs a social engineering tactic known as "ClickFix," where attackers create convincing Cloudflare CAPTCHA pages to deceive users into executing malicious commands in Terminal. This process removes macOS quarantine attributes and installs further payloads in the /tmp directory. The final payload, a native macOS binary compiled with Nuitka, is designed to evade detection by security tools. Once active, Infiniti Stealer can extract credentials from Chromium and Firefox browsers, macOS Keychain, crypto wallets, and developer key files. It also features sandbox detection and delayed execution to avoid tracking.