PamStealer Infection Marker Files Created Under com.apple.finder.core

Duo Tech@duotech

•updated Jul 6, 2026•2•0•2

This rule detects the creation of specific hidden files ('.Maccy', '.lock', '.config') within the 'Library/Application Support/com.apple.finder.core/' directory on macOS. This behavior is indicative of potential persistence mechanisms, configuration tampering, or malicious activity related to the Finder application environment.