Researchers have discovered a never-before-seen piece of macOS malware that mixes a sequence of intelligent tradecraft to contaminate Macs with stealthy, custom-developed credential-stealing code.
The malware is delivered in two phases. The first is distributed in a disk picture that masquerades as Maccy, a clipboard supervisor for Macs. It’s compiled as AppleScript that’s notable for the way in which it delivers the second stage. The malware is known as PamStealer as a result of the Rust-written infostealer makes use of the Pluggable Authentication Modules interface constructed into macOS to validate the goal’s login password earlier than sending it to an attacker-controlled server.
A quieter execution chain
The use of each disk picture and AppleScript is widespread in malware for Macs. More uncommon is the way in which PamStealer combines them to achieve stealth. When the AppleScript is double-clicked, it’s opened within the macOS Script Editor, the place the malicious performance is buried deep inside the file.
“Rather than counting on shell instructions comparable to curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader that retrieves and phases the payload utilizing native Objective-C APIs,” researchers from Jamf, a safety agency for macOS customers, wrote. “Combined with a Rust-based second stage and a password seize workflow that validates credentials regionally by PAM, the result’s a quieter execution chain than we usually observe in commodity macOS stealers.”
When a person, anticipating to put in a reliable clipboard supervisor, encounters the disk picture, they’re prompted to press Command-R instantly after double-clicking it. This command executes malicious code contained in the AppleScript immediately. It additionally permits the execution to bypass com.apple.quarantine, a macOS attribute that gives warnings and restrictions when executable recordsdata have been downloaded from the Internet.
As Jamf defined:
PamStealer combines a lately rising supply floor with a much less acquainted payload. While the clickable .scpt and Script Editor lure construct on tradecraft that’s already gaining adoption throughout the macOS risk panorama, the malware distinguishes itself by a self-contained JXA dropper, a Rust-based second stage, and a password seize workflow that validates credentials regionally by PAM earlier than harvesting them. That second stage places appreciable effort into staying hidden, masquerading as Finder, encrypting its command-and-control visitors, and holding again prompts just like the Full Disk Access request for so long as forty minutes so its exercise doesn’t line up with launch. Together, these behaviors illustrate how commodity macOS stealers proceed to evolve, adopting quieter execution chains and native implementations that scale back conventional detection alternatives whereas remaining suitable with customary macOS options.
The first stage places its payload inside an app bundle that impersonates actual parts constructed into macOS. The part adjustments from pattern to pattern of the malware. Finder.app underneath com.apple.finder.core or com.apple.finder.monitor, and a Software Update.app underneath com.apple.safety.daemon, are two examples. In both case, they run hidden. They additionally show macOS’s real Finder.icns as its icon.
