恶意软件 Infiniti Stealer 通过伪造验证码攻击 Mac 用户加密钱包

Gate News 消息,3 月 30 日,GoPlus Security 披露,一款名为 Infiniti Stealer 的窃密恶意软件正通过"ClickFix"社会工程学攻击手法,针对 Mac 用户的加密钱包及敏感凭证实施窃取。攻击者伪造高度仿真的 Cloudflare 验证码页面,诱导用户打开终端并手动粘贴执行恶意命令。命令执行后,脚本将移除 macOS 隔离属性,并将后续载荷写入 /tmp 目录静默运行。最终载荷为经 Nuitka 编译的原生 macOS 二进制文件,大幅提升了安全工具的检测难度。Infiniti Stealer 一旦部署,可窃取 Chromium/Firefox 浏览器凭证、macOS 钥匙串、加密钱包及开发者密钥文件(如 .env 文件),并具备沙箱检测与延迟执行能力以规避追踪。

Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.
Opmerking
0/400
Geen opmerkingen