{"id":2335,"date":"2026-07-06T00:38:45","date_gmt":"2026-07-06T00:38:45","guid":{"rendered":"https:\/\/xrpfaucet.site\/?p=2335"},"modified":"2026-07-06T00:38:45","modified_gmt":"2026-07-06T00:38:45","slug":"fake-mac-clipboard-app-delivers-new-password-stealing-malware","status":"publish","type":"post","link":"https:\/\/xrpfaucet.site\/?p=2335","title":{"rendered":"Fake Mac Clipboard App Delivers New Password-Stealing Malware"},"content":{"rendered":"
\n

\ud83d\udcf0 Exclusive Crypto News & Analysis:<\/strong> Stay ahead with the latest developments in the cryptocurrency and blockchain space.<\/p>\n

\ud83d\udcc8 Market Update:<\/strong> Real-time price movements, technical analysis, and trading signals.<\/p>\n

<\/p>\n

\n
\n

In brief<\/h4>\n
    \n
  • Jamf Threat Labs identified a new Rust-based macOS infostealer posing as the Maccy clipboard manager.<\/li>\n
  • The malware validates victims’ passwords through macOS PAM before stealing them.<\/li>\n
  • Researchers also spotted ClickFix-style malware delivered through a sponsored advertisement on X.<\/li>\n<\/ul>\n<\/div>\n

    Mac users searching for the open-source clipboard manager Maccy are being targeted by a fake version of the app that installs a new Rust-based infostealer dubbed PamStealer, according to cybersecurity firm Jamf Threat Labs. If successful, the malware could steal users\u2019 passwords and crypto wallet keys.<\/p>\n

    In a report<\/a> published on Thursday, Jamf Threat Labs said the campaign uses a lookalike website to distribute a disk image containing a malicious AppleScript file named Maccy.scpt. When opened, the file displays instructions telling users to run it in Apple’s Script Editor while hiding the malicious code further down the document.<\/p>\n

    \u201cWe are tracking this malware under the name PamStealer after one of its core behaviors: validating the victim\u2019s login password through the macOS Pluggable Authentication Modules (PAM) before harvesting it,\u201d Jamf Threat Labs wrote.<\/p>\n

    From there, the malware uses JavaScript for Automation and native macOS APIs to download a second-stage payload without relying on common shell utilities such as curl or zsh, reducing the number of processes security tools can observe.<\/p>\n