Fake Mac Clipboard App Delivers New Password-Stealing Malware – Decrypt

Mac customers looking for the open-source clipboard supervisor Maccy are being focused by a faux model of the app that installs a brand new Rust-based infostealer dubbed PamStealer, in accordance with cybersecurity agency Jamf Menace Labs. If profitable, the malware might steal customers’ passwords and crypto pockets keys.

In a report revealed on Thursday, Jamf Menace Labs stated the marketing campaign makes use of a lookalike web site to distribute a disk picture containing a malicious AppleScript file named Maccy.scpt. When opened, the file shows directions telling customers to run it in Apple’s Script Editor whereas hiding the malicious code additional down the doc.

“We’re monitoring this malware below the title PamStealer after certainly one of its core behaviors: validating the sufferer’s login password by way of the macOS Pluggable Authentication Modules (PAM) earlier than harvesting it,” Jamf Menace Labs wrote.

From there, the malware makes use of JavaScript for Automation and native macOS APIs to obtain a second-stage payload with out counting on frequent shell utilities similar to curl or zsh, decreasing the variety of processes safety instruments can observe.



“With many stealers, we now have seen attackers buying Google Advert house to lure customers to the malicious app. We have now lately noticed malicious adverts being hosted on X as nicely,” Jamf Menace Labs Director Jaron Bradley instructed Decrypt. “These social engineering methods have confirmed to be extremely profitable.”

In line with the report, the second stage is a Rust-based binary designed for Apple Silicon Macs that disguises itself as Finder or Software program Replace.

“Reasonably than storing its configuration in cleartext, the dropper derives a key from a fingerprint of the host—together with its CPU structure, locale, keyboard structure, and time zone—and makes use of it to unlock an encrypted, integrity-checked configuration containing the payload URL and set up path,” the corporate stated.

As soon as put in, the malware can steal browser credentials and Keychain information, monitor clipboard contents, set up persistence, and ship stolen info to a distant command-and-control server utilizing encrypted communications. If it will possibly’t confirm that it is operating on its meant goal, then it quietly shuts itself down.

The malware additionally makes an attempt to broaden its entry by displaying a faux Finder alert asking customers to grant Full Disk Entry. The immediate can seem as much as 40 minutes after an infection, making it much less seemingly that customers will affiliate it with the unique obtain. If permitted, the malware can entry protected information, together with Mail, Messages, and Time Machine backups.

In line with Bradley, Jamf has not noticed any proof that PamStealer is lively within the wild; nevertheless, the corporate notified Apple of its findings. Apple didn’t instantly reply to a request for remark by Decrypt.

Jamf stated it’s seeing comparable social engineering methods unfold to different platforms. 

In an X put up final week, the corporate stated it was investigating a sponsored commercial on X selling DynamicLake that redirected customers to dynamicmacisland[.]com, the place they had been instructed to open Terminal and execute an set up command.

“The commercial was delivered by way of a verified X account, including one other layer of belief to the social engineering,” the agency wrote. “Evaluation of the payload revealed a current Atomic (MacSync) Stealer variant.”

The findings come as attackers more and more disguise malware as official software program and abuse trusted developer platforms and promoting channels. Latest campaigns have included a faux OpenAI repository that reached the highest of Hugging Face’s trending tasks earlier than distributing a Rust-based infostealer, a malicious Visible Studio Code extension that GitHub stated uncovered roughly 3,800 inside repositories, and the Shai-Hulud software program supply-chain marketing campaign focusing on improvement instruments utilized by AI firms together with OpenAI and Mistral AI.