New macOS Malware 'PamStealer' Uses Stealthy Two-Stage Attack to Harvest User Credentials

Security researchers have identified a previously unknown macOS malware that combines multiple sophisticated attack techniques to covertly implant a custom credential-stealing payload on Mac devices.

Two-Stage Infection Mechanism

According to reporting by Ars Technica, the malware — dubbed PamStealer — operates through a two-stage infection chain:

• Stage One: The malware is distributed via a disk image file disguised as Maccy, a legitimate Mac clipboard management application, tricking users into downloading and installing it.
• Stage Two: The first-stage component, compiled in AppleScript, covertly deploys the second-stage malicious payload, ultimately executing credential theft on the compromised system.

Naming and Threat Characteristics

PamStealer's name is closely tied to its attack methodology. The malware is specifically engineered to evade detection and maintain long-term persistence on victim systems, posing a significant security risk to Mac users.

Full technical details have been publicly disclosed by the researchers. Mac users are advised to remain vigilant, avoid downloading applications from unofficial sources, and keep their operating systems and security software up to date.

Original reporting: Ars Technica / Slashdot

原文來源： 查看原文