GoPlus Issues Critical Warning Over New Mac Crypto Malware Attack

Security platform GoPlus has issued a critical cybersecurity alert, warning cryptocurrency users of a sophisticated new social engineering attack dubbed ‘Infiniti Stealer’ that specifically targets Mac systems. This emerging threat represents a significant escalation in malware tactics aimed at digital asset holders.

Infiniti Stealer Malware Targets Mac Crypto Users

On February 15, 2025, the GoPlus security team publicly disclosed the active spread of Infiniti Stealer through its official communication channels. Consequently, the security community immediately began analyzing the attack’s methodology. This malware campaign employs advanced social engineering techniques to compromise Apple’s macOS environment. Historically, Mac users have enjoyed a reputation for relative security compared to Windows systems. However, targeted attacks like Infiniti Stealer demonstrate a clear shift in criminal strategy toward high-value cryptocurrency targets regardless of platform.

The attack’s primary vector involves a deceptive fake Cloudflare CAPTCHA page. Malicious actors distribute this page through various channels, including:

• Compromised websites and fraudulent advertisements
• Phishing emails disguised as legitimate service notifications
• Social media messages and direct communications

When users encounter this fake CAPTCHA, the page prompts them to execute what appears to be a verification script. This script, however, contains malicious code that installs the Infiniti Stealer payload. The malware operates with user-level permissions initially, then escalates its privileges to access protected system areas.

Technical Analysis of the Attack Vector

Security researchers have identified several sophisticated elements within the Infiniti Stealer attack chain. The malware utilizes fileless execution techniques, meaning it often runs directly in memory without writing a persistent file to disk initially. This approach helps it evade traditional signature-based antivirus detection. Furthermore, the malware employs code obfuscation and encryption to hide its malicious functions from security software.

Once executed, Infiniti Stealer performs a multi-stage data harvesting operation. Its capabilities extend far beyond simple credential theft. The malware systematically scans for and extracts information from numerous sources, creating a comprehensive profile of the victim’s digital assets and access points.

Expert Insight on macOS Security Vulnerabilities

Cybersecurity experts note that Infiniti Stealer exploits specific trust models within the macOS ecosystem. Apple’s Gatekeeper and Notarization services provide robust protection against unverified software. However, social engineering attacks that trick users into manually overriding these protections remain effective. The fake CAPTCHA presents a familiar, trusted interface (Cloudflare) to lower user suspicion.

Independent security analyst Michael Chen explains, “The sophistication lies in the social engineering, not just the code. Attackers understand that cryptocurrency users frequently encounter CAPTCHA systems on exchange platforms and DeFi websites. Therefore, they’ve created a perfect psychological trap using this familiarity.”

The table below outlines the primary data targets of Infiniti Stealer:

Immediate Response and Mitigation Strategies

GoPlus has provided clear guidance for users who suspect infection. The platform strongly recommends immediately disconnecting the affected device from all networks. This includes both internet and local network connections. Subsequently, users should not attempt to access any cryptocurrency wallets or sensitive accounts from the compromised system.

The security firm emphasizes the necessity of a complete system reset for confirmed infections. This process should involve:

• Booting from a clean, verified macOS recovery drive
• Using Disk Utility to completely erase the main storage drive
• Performing a fresh installation of macOS from Apple’s official servers
• Restoring personal data only from clean, pre-infection backups

Following system restoration, users must reset credentials for all potentially exposed accounts. This includes email, financial services, social media, and all cryptocurrency exchange and wallet accounts. Enabling multi-factor authentication (MFA) on every possible account becomes critically important at this stage.

The Evolving Landscape of Cryptocurrency Threats

The emergence of Infiniti Stealer coincides with a broader trend of increasingly sophisticated cryptocurrency-targeted malware. Throughout 2024, security firms documented a 47% increase in macOS-specific threats aimed at digital asset theft compared to the previous year. This growth reflects the expanding value locked in cryptocurrency ecosystems and the relative security awareness gaps among some user groups.

Blockchain security companies now recommend several proactive measures for all cryptocurrency participants:

• Using hardware wallets for significant asset storage
• Maintaining separate devices for high-value transactions versus general browsing
• Implementing comprehensive endpoint protection with behavioral analysis
• Regularly auditing system permissions and installed applications
• Educating oneself on the latest social engineering tactics

Industry-Wide Security Collaboration

The disclosure by GoPlus follows established cybersecurity coordination protocols. The company likely shared technical indicators of compromise (IOCs) with other security vendors through established threat intelligence networks. This collaboration enables broader detection and prevention across the security ecosystem. Major antivirus providers have reportedly updated their definitions to detect Infiniti Stealer variants following this disclosure.

Conclusion

The Infiniti Stealer campaign represents a significant and sophisticated threat to Mac-based cryptocurrency users. This malware attack leverages advanced social engineering through fake Cloudflare CAPTCHA pages to bypass security measures and harvest sensitive data. Users must maintain heightened vigilance against unsolicited verification requests and implement robust security practices. The cybersecurity community continues to monitor this threat while developing more effective countermeasures against evolving cryptocurrency malware like Infiniti Stealer.

FAQs

Q1: How does Infiniti Stealer initially infect a Mac system?
The malware spreads through a social engineering attack where users encounter a fake Cloudflare CAPTCHA page. This page tricks them into executing malicious code that appears to be a verification script, thereby installing the Infiniti Stealer payload.

Q2: What specific data does Infiniti Stealer target on infected systems?
The malware primarily targets cryptocurrency wallet credentials, private keys, and seed phrases. Additionally, it harvests passwords from the macOS Keychain, browser data, developer secrets, API keys, and system information to enable comprehensive account compromise.

Q3: What should I do immediately if I suspect my Mac is infected with this malware?
Immediately disconnect your device from all networks (Wi-Fi and Ethernet). Do not access any cryptocurrency wallets or sensitive accounts. Follow GoPlus’s recommendation to stop using the device and begin the process of resetting all account credentials from a clean, secure device.

Q4: Why are Mac users specifically targeted by this cryptocurrency malware?
While macOS has strong security foundations, its growing market share among developers and cryptocurrency enthusiasts makes it an attractive target. Additionally, some Mac users may have a false sense of security, making them vulnerable to sophisticated social engineering attacks like the fake CAPTCHA used by Infiniti Stealer.

Q5: How can I protect myself from similar malware attacks in the future?
Employ multiple security layers: use hardware wallets for significant funds, maintain updated endpoint protection software, enable multi-factor authentication everywhere possible, be skeptical of unexpected verification requests, and regularly educate yourself on evolving cybersecurity threats targeting cryptocurrency holders.