New Malware Targets Mac Users via Fake Clipboard App

Cybersecurity firm Jamf Threat Labs has identified a new infostealer malware dubbed PamStealer, which impersonates the open-source Maccy clipboard manager on macOS. This malware uses a lookalike website to deliver a malicious disk image containing an AppleScript file named Maccy.scpt, designed to covertly extract user credentials.

Once the user opens the file, it instructs them to run it in Apple's Script Editor, enabling the escalation of privileges without raising alarms. PamStealer verifies victims’ login passwords via macOS's Pluggable Authentication Modules (PAM) before stealing them. Jamf Threat Labs notes that this malware implements sophisticated techniques to avoid detection. Notably, it employs JavaScript for Automation and native APIs to download a secondary payload while evading detection methods employed by most security tools.

In their analysis, Jamf Threat Labs highlighted the increasing trend of cybercriminals leveraging Google Ads and social media platforms like X to promote fake applications, which has proven effective in tricking users. Jamf’s Director Jaron Bradley stated,

“With many stealers, we have seen attackers purchasing Google Ad space to lure users to the malicious app. We have recently observed malicious ads being hosted on X as well.”

The secondary payloads are Rust-based binaries disguised as legitimate macOS processes, such as Finder or Software Update, making them harder to detect. Instead of using cleartext for storage, this malware generates a key based on various host fingerprints (CPU architecture, locale, keyboard layout, and time zone). This method ensures secure and discrete access to configuration files that contain the payload and installation instructions.

The capabilities of PamStealer extend to stealing credentials stored in browsers, accessing macOS's Keychain data, monitoring clipboard activity, establishing a persistent presence on infected devices, and exfiltrating stolen information to remote locations. The emergence of PamStealer underscores the growing risks users face from seemingly benign applications, particularly in the cryptocurrency realm where sensitive information is often at stake.