Overview
- Jamf Threat Labs published a technical analysis Thursday that named the campaign PamStealer and security firms including ManageEngine and major tech outlets independently corroborated the delivery chain and published indicators of compromise.
- The attack starts on a fake Maccy download site that lures victims to open a disk image and a compiled AppleScript which runs a self-contained JavaScript for Automation downloader that stages the second-stage payload when a user executes the file.
- PamStealer displays a native-looking authorization prompt and validates the entered login password through macOS Pluggable Authentication Modules (PAM) before keeping it, which lets operators discard wrong passwords and retain only credentials they can use.
- A Rust second-stage stealer then harvests browser cookies, saved credentials, SQLite databases, clipboard contents and wallet data, encrypts exfiltration to command-and-control servers, and uses runtime-loaded frameworks, ad-hoc codesigning and Finder impersonation to reduce detection signals.
- Published IOCs include the lure domain maccyapp[.]com, C2 names like avenger-sync[.]live and avengerflow[.]com, bundle IDs such as com.apple.finder.core and markers like .Maccy; users should download apps only from official sites or the App Store, treat unexpected admin prompts with suspicion, review Full Disk Access requests, and have EDR rules flag Finder or Software Update bundles running from user paths.