New Mac Malware PamStealer Disguises as Clipboard Tool to Steal Passwords

CoinFeed reported on July 6, according to Decrypt, cybersecurity firm Jamf Threat Labs discovered a new Mac infostealer named PamStealer, spreading disguised as a counterfeit version of the open-source clipboard manager Maccy. The malware lures users via spoofed websites to run an AppleScript file containing malicious code, using macOS Pluggable Authentication Modules to verify and steal user passwords. To evade security tool detection, PamStealer uses JavaScript and macOS APIs to download the second-stage payload. The second-stage is a Rust-based binary disguised as Finder or Software Update, which can steal browser credentials and Keychain data, monitor clipboard content, and establish persistence.