Fake Maccy site ships PamStealer, macOS infostealer built to grab passwords, Keychain data, and wallet keys
decrypt.co •
Revision history
3 recorded changes
Want your article here?
Promote with Leviathan NewsJamf Threat Labs found PamStealer packaged as a fake Maccy clipboard manager on maccyapp[.]com, with an AppleScript dropper and a Rust second stage keyed to Apple silicon Macs. It validates the victim's login password through PAM, watches the clipboard, grabs Keychain and wallet-extension data, and can wait up to 40 minutes before pushing a fake Finder Full Disk Access prompt. Jamf told Decrypt it has not seen PamStealer active in the wild; Apple was notified and had not responded by publication.
TLDR by @Benthic
Explore the topic
More on Wallet
eToro invests in Extended, partners with Zengo wallet to bridge traditional and decentralized finance
𝕏/@extendedapp ·
Robinhood announces wallet integration with Lighter for perpetual futures trading on Robinhood Chain.
𝕏/@Lighter_xyz ·
MetaMask launches Money Account, letting users earn up to 4% APY on mUSD while spending and trading from one self-custodial wallet account.
The Block ·
Chainalysis proposes tracing ontology to separate wallet clusters from attribution claims
Chainalysis ·
Zcash developers rally around a “breach all gates” vision as ZODL ships major wallet upgrades, advances Ironwood migration, and expands privacy-focused infrastructure
𝕏/@jswihart ·
Midnight temporarily suspends Glacier Drop redemptions after SecondFi-linked Cardano wallet security incident
midnight.network ·
eToro invests in Extended, partners with Zengo wallet to bridge traditional and decentralized finance
𝕏/@extendedapp ·
Robinhood announces wallet integration with Lighter for perpetual futures trading on Robinhood Chain.
𝕏/@Lighter_xyz ·
MetaMask launches Money Account, letting users earn up to 4% APY on mUSD while spending and trading from one self-custodial wallet account.
The Block ·
Chainalysis proposes tracing ontology to separate wallet clusters from attribution claims
Chainalysis ·
Zcash developers rally around a “breach all gates” vision as ZODL ships major wallet upgrades, advances Ironwood migration, and expands privacy-focused infrastructure
𝕏/@jswihart ·
Midnight temporarily suspends Glacier Drop redemptions after SecondFi-linked Cardano wallet security incident
midnight.network ·