PamStealer spreads via fake Maccy .scpt and extracts Mac login credentials
Source headline: PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords
Intelligence Summary
Jamf Threat Labs analyzed a macOS information stealer dubbed PamStealer. It is delivered as a compiled AppleScript (.scpt) file that impersonates Maccy, a legitimate clipboard manager. The malware performs checks designed to decide whether to continue and then collects sensitive information. PamStealer targets Mac systems to steal login credentials, including those used for macOS access. Users should watch for suspicious Maccy-branded .scpt downloads and ensure macOS security controls are enabled.
Recommended Action
Confirm whether the affected technology is in use in your environment before deciding on remediation. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.