Daily English Article — July 4, 2026

Spain delivered a dominant performance at SoFi Stadium in Inglewood, California, defeating Austria 3-0 in the round of 32 of the 2026 FIFA World Cup on Thursday, July 2. Widely regarded as tournament favorites, Spain controlled possession from the opening whistle and rarely allowed Austria a meaningful chance to threaten their goal. The result was never seriously in doubt, as the Spanish side showcased the technical quality and tactical discipline that has defined their campaign throughout the competition.

The breakthrough came in the 36th minute when Mikel Oyarzabal broke the deadlock for La Roja, finishing with composure to give Spain the lead they had been threatening to take. Austria struggled to create genuine opportunities throughout the first half, with Spain's defense remaining organized and resolute. The Austrian side made substitutions at halftime in an attempt to shift the momentum, but Spain maintained their grip on proceedings and continued to threaten on the counter-attack and through set pieces.

Pedro Porro doubled Spain's advantage in the 66th minute with a well-timed header, latching onto a precise delivery from Alex Baena inside the penalty area. The goal effectively ended Austria's hopes of mounting any meaningful comeback. Young superstar Lamine Yamal came close to adding to the tally, but Austria captain David Alaba produced a crucial goalline block to deny him. Spain then introduced fresh legs from the bench, bringing on Ferran Torres and Mikel Merino as the game entered its final stages.

Oyarzabal capped off a superb individual display by netting his second goal of the match just before the 90th minute, sealing Spain's comprehensive 3-0 victory. The strike brought his tournament tally to four goals, underlining his importance to the Spanish attack. Spain's defense once again kept a clean sheet, a remarkable achievement that means they have conceded zero goals throughout the entire tournament so far, demonstrating their exceptional solidity at the back.

With the victory secured, Spain advances to the round of 16 for the third consecutive World Cup, extending their impressive record in the knockout stages. They will now await the winner of the match between Portugal and Croatia to determine their next opponent. The performance reinforced Spain's status as one of the most complete teams in the competition, combining clinical finishing with defensive excellence and the technical brilliance of players like Oyarzabal and Yamal across every line of the pitch.

Security researchers have identified a previously unknown piece of macOS malware called PamStealer, which employs a sophisticated combination of techniques to stealthily steal credentials from infected Mac computers. The malware is delivered in two distinct stages and is notable for the way it disguises itself as legitimate software. Researchers from Jamf, a cybersecurity firm specializing in Apple device management, published findings detailing the malware's unusually complex and evasive execution chain, which sets it apart from more common credential-stealing threats targeting macOS.

The first stage of PamStealer is distributed inside a disk image file that impersonates Maccy, a legitimate and widely used clipboard manager application for Mac. This file is compiled as an AppleScript, and when a user double-clicks it, macOS Script Editor opens the file, concealing the malicious code deep within the script. Crucially, pressing Command-R as prompted executes the malicious functionality while simultaneously bypassing com.apple.quarantine, a built-in macOS security attribute designed to warn users about files downloaded from the internet.

Rather than relying on conventional shell commands such as curl or zsh, PamStealer's AppleScript executes a self-contained JavaScript for Automation downloader that retrieves the second-stage payload using native Objective-C APIs. This approach makes the malware's activity considerably harder to detect through standard security monitoring tools. The second stage of the malware is written in Rust, a programming language increasingly favored by malware authors for its performance and the difficulty it presents to reverse engineering and analysis efforts.

PamStealer derives its name from its use of the Pluggable Authentication Modules interface built into macOS. This interface is used to validate the victim's login password locally on the compromised device before transmitting it to an attacker-controlled server, making the credential capture process appear less suspicious. The second stage also masquerades as Finder, Apple's native file manager, and encrypts its command-and-control communications to evade network-based detection. It deliberately delays prompts such as Full Disk Access requests by up to forty minutes after launch to avoid arousing suspicion.

The emergence of PamStealer illustrates a broader trend in which macOS-targeting malware is becoming increasingly sophisticated, adopting quieter execution chains and leveraging native operating system features to reduce detection opportunities. While the use of disk images and AppleScript are already established techniques in the macOS threat landscape, PamStealer's combination of a self-contained JXA dropper, a Rust-based payload, and PAM-based local credential validation represents a meaningful evolution in tradecraft. Security professionals are urged to remain vigilant and keep their systems and security software fully updated.