Mac owners in crosshairs: Infiniti malware steals crypto wallet data via Terminal

Traders Union
All News
Crypto
Mac owners in crosshairs

Technical Features and Hidden Mechanisms of Infiniti

Infiniti Stealer is a sophisticated malware compiled into a native macOS binary, making its detection by antiviruses extremely difficult. The program operates entirely in stealth, triggering no pop-ups or system warnings after the script activation. The stealer’s primary goal is extracting sensitive data from browsers and the system Keychain storage.

It poses a particular danger to cryptocurrency holders, as it is configured to automatically search for crypto wallet files. Additionally, the program scans developer files for API keys and passwords and takes screenshots during operation. To prevent analysis, the malware checks the execution environment for virtual machines and security tools. All stolen data is instantly transmitted to the attackers' remote command server via Telegram.

Rising Threats to Personal Wallets and Theft Statistics

This incident is part of a global trend of increasing attacks on individual cryptocurrency users. Previously, the GhostClaw malware was detected spreading through the npm package manager, successfully attacking approximately 178 developers. According to a Chainalysis report, the total amount of stolen funds in the industry reached a critical mark of $3.4 billion in 2025.

Notably, the share of personal wallet hacks rose from 7.3% in 2022 to a record 44% in 2024. If not for the anomalous scale of the Bybit exchange attack, the share of personal storage compromises in 2025 would have stood at 37%. Hackers are increasingly adapting methods previously characteristic only of Windows to the Apple system architecture. Users are advised to exercise extreme vigilance and never paste third-party code into the system management console.

Risk Analysis and Cybersecurity Trends

The migration of ClickFix-type attacks to the macOS platform marks the end of the "security through obscurity" era for the Apple ecosystem. Analytics show a rapid year-over-year (YoY) growth in attacks on personal wallets, necessitating an immediate transition to Cold Storage hardware methods. The use of native binaries instead of simple scripts increases malware survival rates in the system by 40–60% compared to analogs.

The total damage of $3.4 billion last year emphasizes that developing complex software like Infiniti is a highly profitable business for hacking groups. The practical significance of this news lies in the need to implement strict digital hygiene: refusing to execute any commands from unverified web sources. Given the 44% share of personal wallet compromises, the human factor remains the weakest link in digital asset protection.

Recently we wrote that Google experts have discovered a new iPhone hacking tool that is already being used by crypto scammers. Vulnerabilities in Apple smartphones may allow attackers to gain access to crypto wallets and users’ personal data. If even the iPhone can no longer be considered secure, where should digital assets be stored?

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.