PamStealer malware pretends to be Maccy, steals credentials

A sophisticated new strain of malware targeting macOS users has been identified by security researchers, who warn it is being distributed through fake websites impersonating the popular Maccy clipboard manager. The malware, named PamStealer, is designed to steal login credentials and a wide range of sensitive data through a stealthy, multi-stage attack that leverages legitimate macOS features to evade detection.

According to a report from Jamf Threat Labs, the campaign involves fraudulent websites designed to mimic the legitimate Maccy download page. Users who visit these sites and download what appears to be the application instead receive a malicious AppleScript file disguised as an installer package, typically delivered within a disk image. When executed, this script initiates a payload chain that begins tracking information on the infected Mac.

What distinguishes PamStealer is its technical sophistication and a specific focus on credential validation. The malware derives its name from its use of macOS's Pluggable Authentication Modules (PAM), the system-level framework that handles login verification. After tricking a user into entering their password via a fake system...