Beware. Fake Clipboard app on macOS. Used, addicted to malware.

Beware. Fake Clipboard app on macOS. Used, addicted to malware, steal passwords.

According to a report by the website Decrypt, it specifically discusses the detection of a data theft type malware or an Infostealer named PamStealer with the ability to steal passwords and keys for stealing Crypto Wallet (Crypto Wallet) that focuses on attacking macOS users. This malware was created on the basis of the Rust language and used a self-impersonation as a Clipboard Manager application called Maccy, which a research team from Jamf Threat Labs said that if the victim successfully installs a fake application on the machine, the malware will start stealing data on the machine. In an instant.

The campaign starts with hackers advertising such fake applications on social media like X and through ads on search engines like Google. After the victim presses on the website, there is a file in the form of a Disk Image. There is an Apple Script file called Maccy.scpt. If the victim opens the file, it will enter a scam similar to the ClickFix method (deceiving the victim to follow a command on the screen, deceiving the victim to download the malware) by showing the victim a screenshot. Run such files (where malware code is hidden) through the Script Editor application.

After this procedure is completed, the script will use JavaScript for Automation and the API on macOS to download a second payload file on the machine, a malware named PAMStealer. This malware authenticates the password with macOS's Pluggable Authentication Modules (PAM) before stealing it and then smuggling it out to hackers at the C2 or Command and Control server. This malware has the ability to steal a lot of data from the password data saved on it. Keychain, Web Browser Password and Clipboard etc. There is also a disguise as a Finder application to trick the victim into allowing malware to access data on the full-power hard disk or Full Disk Access. The request appears about 40 minutes after the machine has been infected with the malware. If the victim accidentally approves, the malware will access secret information such as emails, messages, and backups in the Time Machine.

# Trending # lemon 8 diary # clipboard # macos # freedomhack