New PamStealer macOS malware employs advanced techniques to evade detection

Researchers have unveiled a significant new piece of malware targeting macOS systems, identified as PamStealer. This sophisticated software combines multiple techniques to stealthily infiltrate Mac devices and extract user credentials.

PamStealer employs a two-stage infection process. The initial phase involves the distribution of a disk image that masquerades as Maccy, a reputable clipboard manager designed for macOS. This initial stage is crafted using AppleScript, which notably facilitates the delivery of the malware’s second stage. The name PamStealer is derived from its use of the Pluggable Authentication Modules (PAM) interface within macOS, enabling it to validate and capture the target’s login credentials before transmitting them to an external server controlled by the attackers.

One of the distinctive features of PamStealer is its execution chain, which is executed with a degree of stealth that sets it apart from typical malware. Rather than employing conventional shell commands, the AppleScript utilizes a JavaScript for Automation (JXA) downloader, which retrieves and prepares the payload using Apple’s native Objective-C APIs. According to research conducted by a media source, this approach results in a quieter execution process, significantly mitigating the chances of detection.

Once a user attempts to install what they believe to be a legitimate clipboard manager, they are prompted to use the Command-R command after double-clicking the disk image. This specific command triggers the execution of the malicious code encoded within the AppleScript, skillfully bypassing macOS’s quarantine system, which is designed to alert users about potentially hazardous software downloaded from the internet.

The malware’s nuanced delivery method and its use of disguised app bundles further complicate detection. PamStealer utilizes familiar macOS components as cloaking mechanisms and may vary its identity across different samples. Examples of these include Finder.app and a Software Update.app, both of which can operate in the background while appearing to be legitimate system processes. In addition, the malware cleverly employs encryption to protect its command-and-control communications, keeping prompts for full disk access delayed to avoid detection.

In summary, the emergence of PamStealer underscores an alarming trend in the evolution of macOS malware, highlighting the increasing sophistication of cyber threats targeting Apple systems. The integration of advanced methods of delivery and execution reflect a growing need for vigilance among macOS users as cybercriminals continue to refine their tactics to evade detection.

#business #technology