Researchers have discovered a never-before-seen piece of macOS malware that mixes a sequence of intelligent tradecraft to contaminate Macs with stealthy, custom-developed credential-stealing code.
The malware is delivered in two levels. The primary is distributed in a disk picture that masquerades as Maccy, a clipboard supervisor for Macs. It’s compiled as AppleScript that’s notable for the way in which it delivers the second stage. The malware is known as PamStealer as a result of the Rust-written infostealer makes use of the Pluggable Authentication Modules interface constructed into macOS to validate the goal’s login password earlier than sending it to an attacker-controlled server.
A quieter execution chain
The usage of each disk picture and AppleScript is widespread in malware for Macs. Extra uncommon is the way in which PamStealer combines them to achieve stealth. When the AppleScript is double-clicked, it’s opened within the macOS Script Editor, the place the malicious performance is buried deep throughout the file.
“Reasonably than counting on shell instructions similar to curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader that retrieves and levels the payload utilizing native Goal-C APIs,” researchers from Jamf, a safety agency for macOS customers, wrote. “Mixed with a Rust-based second stage and a password seize workflow that validates credentials regionally by PAM, the result’s a quieter execution chain than we sometimes observe in commodity macOS stealers.”
When a consumer, anticipating to put in a reliable clipboard supervisor, encounters the disk picture, they’re prompted to press Command-R instantly after double-clicking it. This command executes malicious code contained in the AppleScript immediately. It additionally permits the execution to bypass com.apple.quarantine, a macOS attribute that gives warnings and restrictions when executable information have been downloaded from the Web.
As Jamf defined:
PamStealer combines a just lately rising supply floor with a much less acquainted payload. Whereas the clickable .scpt and Script Editor lure construct on tradecraft that’s already gaining adoption throughout the macOS risk panorama, the malware distinguishes itself by a self-contained JXA dropper, a Rust-based second stage, and a password seize workflow that validates credentials regionally by PAM earlier than harvesting them. That second stage places appreciable effort into staying hidden, masquerading as Finder, encrypting its command-and-control site visitors, and holding again prompts just like the Full Disk Entry request for so long as forty minutes so its exercise doesn’t line up with launch. Collectively, these behaviors illustrate how commodity macOS stealers proceed to evolve, adopting quieter execution chains and native implementations that cut back conventional detection alternatives whereas remaining suitable with customary macOS options.
The primary stage places its payload inside an app bundle that impersonates actual elements constructed into macOS. The part adjustments from pattern to pattern of the malware. Finder.app beneath com.apple.finder.core or com.apple.finder.monitor, and a Software program Replace.app beneath com.apple.safety.daemon, are two examples. In both case, they run hidden. Additionally they show macOS’s real Finder.icns as its icon.
