Researchers have discovered a never-before-seen piece of macOS malware that mixes a collection of intelligent tradecraft to contaminate Macs with stealthy, custom-developed credential-stealing code.
The malware is delivered in two levels. The primary is distributed in a disk picture that masquerades as Maccy, a clipboard supervisor for Macs. It’s compiled as AppleScript that’s notable for the best way it delivers the second stage. The malware is called PamStealer as a result of the Rust-written infostealer makes use of the Pluggable Authentication Modules interface constructed into macOS to validate the goal’s login password earlier than sending it to an attacker-controlled server.
A quieter execution chain
The usage of each disk picture and AppleScript is widespread in malware for Macs. Extra uncommon is the best way PamStealer combines them to achieve stealth. When the AppleScript is double-clicked, it’s opened within the macOS Script Editor, the place the malicious performance is buried deep throughout the file.
