India’s IT sector may finally be attracting value investors after a prolonged correction, but market expert, Sandip Sabharwal believes the rally is unlikely to evolve into a long-term structural uptrend. While lower valuations and attractive dividend yields have improved the risk-reward equation, he sees the sector as a tactical opportunity rather than a buy-and-hold investment.

“The IT sector has been on a one-way downswing for almost the last year, and over the last three-four years it has gone nowhere. Valuations for TCS and Infosys have come down, so they present opportunities for value investors. But I see this more as a trading sector… we could make 10-20%, but I do not see the trend completely reversing,” he said.

Sabharwal said he has taken small positions in large-cap IT names but intends to exit once they generate reasonable returns instead of holding them for the long term.

DMart’s Valuation Still Looks Stretched

Commenting on Avenue Supermarts‘ first-quarter update, Sabharwal said the retailer continues to deliver respectable operational performance, but its premium valuation remains difficult to justify.

“The performance is fine, but the valuations do not justify the growth. There is no upside to the stock in my view because of the very high valuations. It is unlikely to outperform,” he said.
Even though broader market sentiment remains supportive, he believes any upside in the stock will likely remain limited.
Marico Reinforces Consumption Strength
Marico’s stronger-than-expected quarterly update has strengthened confidence in the consumption story, according to Sabharwal. He pointed to healthy volume growth, improving rural demand and a positive outlook as encouraging signs for the broader FMCG sector.
“The numbers were very-very strong and the outlook also seems quite positive. It gives a positive connotation to the entire consumption space,” he said.

He added that his channel checks indicate consumer demand remained resilient during the first quarter and expects this trend to be reflected in upcoming earnings from other consumer companies.

Margin Pressures Should Ease
While higher input costs could weigh on margins for some FMCG companies in the near term, Sabharwal expects the pressure to be temporary as raw material prices cool.

“Demand has been holding up on the ground. Packaging costs are already below pre-war levels, and those benefits will start coming in. Prices will largely hold and help margins for the rest of the year,” he said.

Auto Sector Well Positioned for Growth
Sabharwal remains constructive on the automobile sector after healthy sales across both conventional and electric vehicles. He believes the ongoing shift toward EVs is also accelerating replacement demand.

“Numbers have been very strong across ICE as well as EV portfolios. EV penetration is touching new records, and replacement demand could keep the momentum going,” he said.

He, however, cautioned that an unfavourable monsoon remains the biggest risk for rural demand.

“The possibility of a poor monsoon remains the key risk, but many earlier concerns have eased. The sector is well placed for growth,” he said.

OEMs and Auto Ancillaries Both Attractive
Sabharwal expects both vehicle manufacturers and component makers to benefit from improving industry conditions, especially as export-related tariff concerns have moderated.

“We own Maruti, M&M and Bajaj Auto. All these companies should do reasonably well. We also have a small holding in Greaves Cotton, which could also do well,” he said.

EV Adoption Has More Room to Grow
The momentum in electric two-wheelers is unlikely to slow anytime soon, Sabharwal said, citing lower running costs and a faster replacement cycle.

“This momentum will continue and the shift is not going to stop. The EV market is huge, and replacement demand could accelerate further,” he said.

Liquidity Will Determine Credit Growth
On the banking sector, Sabharwal said credit growth will eventually depend on the availability of deposits, although expected FCNR inflows could provide temporary support.

“If liquidity does not improve, it will cap credit growth at some stage. FCNR flows could bridge the gap this year, but deposit growth has to keep pace,” he said.

He added that stable foreign fund flows could also improve overall system liquidity.

Tata Motors Still Faces Execution Challenges
Sabharwal believes Tata Motors continues to remain a stock that periodically disappoints despite improvements in its domestic business.

“Tata Motors is always a work in progress. Some quarters are good, then guidance disappoints the market. But domestically they seem to be stabilizing,” he said.

Titan Remains the Preferred Jewellery Bet
Despite strong updates from some jewellery companies, Sabharwal continues to favour Titan over the rest of the sector because of governance concerns elsewhere.

“For many jewellery companies, corporate governance remains a concern. Titan is the only credible player I see. If someone has to play the sector, they should play it through Titan,” he said.

SAN FRANCISCO — A sophisticated new strain of Mac malware is targeting users of one of the most popular third-party clipboard management utilities on macOS, impersonating the app through fake websites and disguised installer files to steal login passwords, according to a threat report published by mobile device management and security firm Jamf Threat Labs.

The malware, which Jamf researchers have named PamStealer, is being distributed through websites designed to mimic the legitimate website of Maccy, a widely used free open-source clipboard history tracker. Users who land on these fraudulent sites and attempt to download what they believe is a legitimate copy of the application instead receive malicious files engineered to compromise their system silently and extract sensitive authentication credentials.

PamStealer’s delivery mechanism relies on AppleScript files disguised as legitimate Maccy installer packages and distributed within disk images, a format Mac users commonly associate with trusted software installations. When a user opens and attempts to run the file, the script triggers a payload chain that begins tracking information on the targeted Mac and transmits collected data to an external threat actor controlling the attack.

The name PamStealer derives from the specific technique the malware uses to extract and validate a victim’s login password through macOS Pluggable Authentication Modules, known as PAM, the system-level authentication framework built into Apple’s operating system that handles credential verification across a wide range of login and privilege escalation scenarios.

What distinguishes PamStealer from earlier generations of Mac malware, according to Jamf’s analysis, is the technical sophistication of its execution chain and its deliberate effort to minimize the signals that conventional detection tools would typically catch. The malware does not use commonly flagged shell commands such as curl or zsh, which many Mac security tools have been trained to treat with suspicion. Instead, the AppleScript payload executes a self-contained JavaScript for Automation downloader that retrieves and stages the malicious payload using native Objective-C application programming interfaces, tools that are part of macOS’s own legitimate software development framework and therefore far less likely to trigger defensive alerts.

A Rust-based second-stage payload follows the initial download, with the combination of techniques producing what Jamf’s researchers described as a notably quiet and difficult-to-detect attack chain.

“Together, these behaviors illustrate how commodity macOS stealers continue to evolve, adopting quieter execution chains and native implementations that reduce traditional detection opportunities while remaining compatible with standard macOS features,” Jamf wrote in its report.

The researchers further noted that while disk images and AppleScript-based malware have both been established components of the Mac threat landscape for years, PamStealer represents a meaningful evolution in how those elements are combined. By pairing them with a local credential validation process through PAM rather than transmitting password attempts outward for external verification, the malware avoids generating the kind of outbound network traffic that endpoint detection tools often monitor for signs of malicious activity. The credential is tested locally against the Mac’s own authentication system before being exfiltrated, reducing the overall noise of the attack and making the infection harder to identify through conventional monitoring.

The Maccy application itself is not compromised. The malware is entirely external to the legitimate software and works solely by exploiting user trust in the Maccy brand and the app’s wide adoption among Mac power users. Maccy has built a following among enthusiasts and professionals because it provides clipboard history functionality that Apple only began offering natively in macOS Tahoe through an update to Spotlight, arriving years after third-party developers had already built dedicated tools to fill the gap. The combination of strong name recognition and a user base comfortable with installing non-App Store software made Maccy a strategically attractive brand for threat actors to impersonate.

To protect themselves from PamStealer specifically, Maccy users should only download the application directly from the official Maccy website, maccy.app, or from the application’s official GitHub repository. Both the official website and the GitHub page carry explicit disclaimers stating that maccy.app is the only official website for the application, a warning that the developer has apparently added in direct response to the emergence of impersonation sites targeting their user base. Any other website distributing a file claiming to be Maccy should be treated as suspect.

More broadly, the threat underscores a set of security habits that Apple, security researchers and enterprise IT teams consistently recommend to Mac users regardless of which application a specific attack happens to target. The safest pathway for obtaining Mac software remains the Mac App Store, where Apple reviews applications before making them available for download and applies a layer of technical sandboxing that limits what even legitimate apps can access on a user’s system. Software obtained directly from a developer through their official website carries somewhat more risk, though that risk is manageable when users take care to verify they are on the correct domain and not a lookalike site.

Users who receive messages containing links to software downloads from unfamiliar or unexpected sources should avoid clicking those links directly. A recommended approach involves Control-clicking any link or button to copy the actual URL before visiting it, then pasting the address into a text editor to inspect the full destination address before proceeding. Links in emails or text messages that claim to lead to known, trusted software download pages are a common vector for delivering malware through exactly the kind of impersonation technique PamStealer employs.

Mac users who want to assess their existing security posture can also consider running one of several reputable third-party Mac security tools that scan for known malware signatures and monitor for unusual system behavior, though Jamf’s report suggests that PamStealer’s design specifically targets detection gaps in conventional tools, making behavioral awareness and careful download hygiene the most reliable defenses for now.

PamStealer’s sophistication reflects a broader and well-documented trend in which Mac-targeted malware has grown significantly more advanced in recent years as the platform’s user base and commercial profile have expanded, attracting greater attention from financially motivated threat actors who once focused almost exclusively on Windows systems. The days when Mac users could rely on relative security through obscurity are long past, and the evolution documented in Jamf’s PamStealer report offers a clear illustration of why.

This article was written by

Analyst’s Disclosure: I/we have no stock, option or similar derivative position in any of the companies mentioned, and no plans to initiate any such positions within the next 72 hours. I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.

Seeking Alpha’s Disclosure: Past performance is no guarantee of future results. No recommendation or advice is being given as to whether any investment is suitable for a particular investor. Any views or opinions expressed above may not reflect those of Seeking Alpha as a whole. Seeking Alpha is not a licensed securities dealer, broker or US investment adviser or investment bank. Our analysts are third party authors that include both professional investors and individual investors who may not be licensed or certified by any institute or regulatory body.