Home / Technology / Mac Malware's Stealthy Password Grab Revealed
Mac Malware's Stealthy Password Grab Revealed
3 Jul
Summary
- New macOS malware uses disk images and AppleScript for stealth.
- PamStealer steals credentials via a fake clipboard manager lure.
- Malware employs native APIs and PAM for quieter execution.
Researchers have uncovered a sophisticated new macOS malware called PamStealer, designed to stealthily steal user credentials. This malware employs a two-stage infection process, beginning with a disk image disguised as a legitimate clipboard manager. The initial stage uses AppleScript to deliver a second stage written in Rust, which leverages macOS's Pluggable Authentication Modules (PAM) to validate login passwords before exfiltration.
PamStealer's execution chain is designed for quiet operation, distinguishing it from typical macOS stealers. It uses a self-contained JavaScript for Automation (JXA) downloader and native Objective-C APIs, avoiding common shell commands. The malware also masquerades as system processes like Finder and delays user prompts, such as Full Disk Access requests, to avoid detection.
The second stage, a lean Mach-O binary for Apple CPUs, includes code to access Ethereum accounts and can request Full Disk Access. It presents a native password prompt, mimicking system authorization requests. Once a correct password is provided, it displays a decoy message indicating file damage, thus attempting to mislead the user about the malicious activity.
