Fake Maccy App Targets Users with New Infostealer
Mac users seeking the open-source clipboard manager Maccy are falling victim to a counterfeit version of the application that installs a new Rust-based infostealer dubbed PamStealer, according to cybersecurity firm Jamf Threat Labs. If successful, the malware poses a significant threat, capable of stealing users’ passwords and cryptocurrency wallet keys.
In a report published Thursday, Jamf Threat Labs detailed how the campaign employs a deceptive website to distribute a disk image containing a malicious AppleScript file named Maccy.scpt. Upon opening, this file presents instructions to users, urging them to run it within Apple’s Script Editor while concealing the malicious code deeper within the document.
“We are tracking this malware under the name PamStealer after one of its core behaviors: validating the victim’s login password through the macOS Pluggable Authentication Modules (PAM) before harvesting it,” Jamf Threat Labs stated.
The malware then leverages JavaScript for Automation and native macOS APIs to download a second-stage payload. This approach avoids common shell utilities like curl or zsh, thereby reducing the number of observable processes for security tools.
“With many stealers, we have seen attackers purchasing Google Ad space to lure users to the malicious app. We have recently observed malicious ads being hosted on X as well,” Jamf Threat Labs Director Jaron Bradley told Decrypt. “These social engineering techniques have proven to be highly successful.”
The second stage, according to the report, is a Rust-based binary specifically designed for Apple Silicon Macs. It disguises itself as either Finder or Software Update to evade detection.
“Rather than storing its configuration in cleartext, the dropper derives a key from a fingerprint of the host—including its CPU architecture, locale, keyboard layout, and time zone—and uses it to unlock an encrypted, integrity-checked configuration containing the payload URL and installation path,” the company explained.
Once installed, the malware can pilfer browser credentials and Keychain data, monitor clipboard contents, establish persistence, and exfiltrate stolen information to a remote command-and-control server using encrypted communications. Crucially, it quietly self-terminates if it cannot verify it is running on its intended target.
The malware also attempts to escalate its privileges by presenting a fake Finder alert that prompts users to grant Full Disk Access. This deceptive prompt can appear up to 40 minutes after infection, making it less likely for users to associate it with the initial download. If granted, the malware gains access to sensitive protected data, including Mail, Messages, and Time Machine backups.
Bradley noted that Jamf has not yet observed any evidence of PamStealer being actively deployed in the wild. Nevertheless, the company has informed Apple of its findings. Apple did not immediately respond to a request for comment from Decrypt.
Jamf also indicated that similar social engineering tactics are appearing on other platforms. Last week, the company reported on X that it was investigating a sponsored advertisement on the platform promoting DynamicLake. This ad redirected users to dynamicmacisland[.]com, where they were instructed to open Terminal and execute an installation command.
“The advertisement was delivered through a verified X account, adding another layer of trust to the social engineering,” the firm wrote. “Analysis of the payload revealed a recent Atomic (MacSync) Stealer variant.”
These discoveries come at a time when attackers are increasingly disguising malware as legitimate software and exploiting trusted developer platforms and advertising channels. Recent campaigns have included a fake OpenAI repository that climbed to the top of Hugging Face’s trending projects before distributing a Rust-based infostealer, a malicious Visual Studio Code extension that GitHub stated exposed approximately 3,800 internal repositories, and the Shai-Hulud software supply-chain campaign targeting development tools used by AI companies such as OpenAI and Mistral AI.
Leave a Reply