New Mac infostealer confirms stolen passwords before stealing data

Jamf Threat Labs documented a new macOS infostealer called PamStealer that verifies Mac login passwords through Apple's Pluggable Authentication Modules before stealing data. PamStealer disguises itself as the Maccy clipboard manager and uses AppleScript with a Rust payload to infect systems.