TLDR Tech / InfoSec
Newly discovered PamStealer isn't your typical macOS malware
PamStealer spreads via a clipboard manager disk image called Maccy that runs AppleScript, which launches a JavaScript for Automation downloader and a Rust-based payload that uses native Objective-C APIs. It bypasses quarantine flags, hides within app bundles mimicking Finder or Software Update, and uses a realistic password prompt to capture credentials via PAM. It then seeks full disk access and can target Ethereum wallets.
Read the full story