Security researchers have uncovered a previously undocumented macOS infostealer that employs an unusually sophisticated execution chain to harvest login credentials from compromised Macs. Dubbed PamStealer, the threat combines a multi-stage delivery mechanism with native macOS interfaces to validate stolen passwords locally before exfiltrating them, marking a significant evolution in commodity macOS malware.
The malware, discovered by researchers at macOS security firm Jamf, arrives in two stages. The initial payload is distributed inside a disk image that impersonates Maccy, a legitimate clipboard manager for macOS. The disk image contains an AppleScript file that, when double-clicked, opens in the macOS Script Editor. The malicious functionality is buried deep within the AppleScript, making it difficult for casual inspection to detect.
What sets PamStealer apart from typical macOS stealers is the way the first stage retrieves and launches the second. Rather than relying on common shell commands such as curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader. This JXA component uses native Objective-C APIs to download and stage the payload, producing a significantly quieter execution chain than what security teams typically observe in commodity Mac infostealers.
Stealth Through Native macOS Mechanisms
The disk image lure instructs the victim to press Command-R immediately after double-clicking the file, a step that executes the malicious code within the AppleScript directly. Critically, this keyboard shortcut also allows the execution to bypass com.apple.quarantine, the macOS attribute that normally displays warnings and imposes restrictions on executable files downloaded from the internet. This quarantine bypass is a key stealth technique that reduces the likelihood of the user receiving a security prompt before the malware runs.
Once the first stage executes, it drops the second-stage payload inside an app bundle that impersonates legitimate macOS components. The specific component name varies between samples. Researchers observed bundles posing as Finder.app under identifiers such as com.apple.finder.core or com.apple.finder.monitor, as well as Software Update.app under com.apple.security.daemon. In both cases, the malicious process runs hidden from the user and displays macOS’s genuine Finder.icns icon to further avoid suspicion.
Rust-Written Second Stage with PAM-Based Credential Validation
The second stage of PamStealer is written in Rust, a language increasingly favored by malware authors for its cross-platform capabilities and difficulty of reverse engineering. This stage performs the core credential-stealing functionality. The malware takes its name from its use of macOS’s Pluggable Authentication Modules (PAM) interface to validate the target’s login password locally before sending it to an attacker-controlled command-and-control server. This local validation step ensures that the stolen credentials are correct, reducing the chance of triggering alerts with failed login attempts and increasing the value of the exfiltrated data.
Jamf researchers noted that the Rust stage puts considerable effort into remaining hidden. It masquerades as Finder, encrypts its C2 traffic, and deliberately delays sensitive prompts — such as the Full Disk Access permission request — for up to forty minutes after launch. This timing separation makes it harder for users or monitoring tools to correlate the prompt with the initial infection event.
What PamStealer Means for macOS Users
PamStealer represents a notable step forward in the sophistication of commodity macOS malware. While the use of disk images and AppleScript lures is well-established in Mac-focused threats, the combination of a JXA dropper using native APIs, a Rust-based second stage, and PAM-based credential validation creates a quieter and more resilient infection chain than security teams typically encounter. The malware is designed to reduce traditional detection opportunities while remaining fully compatible with standard macOS features.
For users, the primary risk comes from downloading and opening disk images from untrusted sources, even when they appear to be legitimate applications. The PamStealer campaign specifically targets users searching for clipboard manager software, but the delivery technique could easily be adapted to impersonate other popular Mac utilities.
How to Protect Your Mac Against Credential-Stealing Malware
The most effective defense against threats like PamStealer is a combination of cautious behavior and appropriate security tools. Users should only download software from the official Mac App Store or directly from the developer’s verified website. Never open disk images or run AppleScript files from unverified sources, even if they appear to be from a known application.
Enable Gatekeeper on your Mac to ensure that only notarized applications can run, and avoid overriding security warnings unless you are absolutely certain of the source. Consider deploying a multi-layer endpoint protection solution that includes real-time threat detection and behavioral analysis capabilities, as traditional signature-based antivirus may not catch novel threats like PamStealer. For users handling sensitive credentials, a reputable password manager with zero-knowledge architecture can limit the damage of a single credential compromise by ensuring that no two accounts share the same password.
What Affected Users Should Do Now
If you suspect your Mac has been compromised by PamStealer or any credential-stealing malware, take immediate action. Change your macOS login password and the passwords for all critical accounts — particularly email, banking, and cloud storage — using a separate, known-clean device. Enable two-factor authentication on every account that supports it, and monitor your accounts for unauthorized access. Consider running a full security scan using a trusted endpoint protection suite, and if you downloaded a disk image claiming to be Maccy or any clipboard manager from an unofficial source recently, treat that system as potentially compromised.
