PamStealer: Fake Finder/Software Update Bundle Staged in Application Support

Duo Tech@duotech

•updated Jul 6, 2026•1•0•0

Detects file creation or write operations within protected macOS System 'Application Support' directories that mimic legitimate Finder or system component filenames. This behavior is indicative of an attacker attempting to masquerade malicious files or persistence mechanisms as core macOS system utilities.