Fake Finder in Application Support Repeatedly Spawns pbpaste to Harvest Clipboard
Detects repeated execution of the 'pbpaste' command initiated by the 'Finder' application where the parent process path originates from within the '/Library/Application Support/' directory. This behavior is indicative of a potentially malicious macOS plug-in or background component attempting to periodically monitor and extract clipboard data.
Cortex XDR
