PamStealer Mac Malware and the One Rule That Protects Home Macs
Mac owners can be forgiven for thinking malware is a Windows problem. This week's research on PamStealer is a reminder that it isn't, though it's also worth being clear about who this particular threat is aimed at.
PamStealer is a piece of macOS malware that researchers say has been updated with live, two-way communication to the attacker, plus several different methods of staying on the machine once it's there. The vendors treat it as a serious concern, and it deserves attention. But the usage we're seeing reported is targeted, leaning towards corporate and high-value users rather than a broad spray across home computers. That matters. If you're a family with a Mac in the living room, you are not the intended victim here.
So how does something like this get onto a Mac at all? Usually the same ways as before. You install something you didn't ask for, disguised as a player, a plugin or a converter. Or someone talks you into running a command you didn't understand.
The second one is the pattern to know. A web page pops up with a warning, something like your browser has a problem or your connection needs a quick fix. It invites you to open the Terminal app and paste in a line of text. That line of text is the infection.
There is no good reason for a website to ask you to do this. No genuine security tool works that way. No real support agent needs you to paste commands into your Mac to sort out a pop-up. So the rule is simple and it holds in every case: if a website or a pop-up tells you to open Terminal and paste something in, close the window.
If you think you've already done it, the response is calm and straightforward. Update macOS to the latest version. Change your important passwords, and do it from a different device so you're not typing new passwords into a machine you don't trust. Then get the Mac checked over, either with a tool you trust or by someone who knows Apple kit.
One more note from this week. A US soldier was sentenced to 70 months in prison for extorting phone networks. Extortion and blackmail carry real prison time and real consequences. If you're ever threatened that way, report it. Don't pay.
And a line on the dark web side, since we do monitor it. Another ransomware operation has started up, with a leak site already active. The vast majority of these groups go after businesses and organisations, not households. There's nothing extra you need to do about that one.
Takeaway for this weekend: never paste a command into your Mac because a website told you to.
Related reading