PamStealer: The macOS Malware That Actually Did Its Homework
Security researchers at Jamf have turned up a previously unknown piece of macOS malware that stands out from the usual crop of sloppy infostealers. Dubbed PamStealer, it combines several layers of tradecraft that, taken together, make it considerably harder to catch than most commodity threats targeting Macs.
The attack arrives disguised as Maccy, a legitimate clipboard manager. The disk image looks innocent enough, but the real action happens inside an AppleScript that buries its malicious functionality deep in the file. When a user double-clicks it, they're told to press Command-R straight away. That keystroke executes hidden code directly inside macOS Script Editor and, crucially, bypasses the com.apple.quarantine attribute that would otherwise flag downloaded executables and throw up warnings.
So far, so standard. Disk images and AppleScript are both well-worn tools in the macOS malware playbook. What sets PamStealer apart is what happens next.
Rather than reaching for shell commands like curl or zsh — the sort of thing endpoint tools are well-trained to catch — the first stage runs a self-contained JavaScript for Automation (JXA) downloader that fetches the second stage payload using native Objective-C APIs. No suspicious child processes, no obvious network calls.
The second stage is a lean Mach-O binary written in Rust, which is an unusual choice for macOS malware. Swift, Go, and Objective-C are far more common. It bundles a SQLite reader to access database files directly and impersonates legitimate macOS components to stay hidden. Samples have been observed masquerading as Finder.app under com.apple.finder.core or a Software Update.app under com.apple.security.daemon, complete with macOS's genuine Finder icon. It runs silently in the background.
The password-theft mechanism is where things get genuinely clever. PamStealer displays a native-looking system prompt that reads: "Maccy wants to make changes. Enter your password to allow this." When the user obliges, the malware validates the password locally using macOS's Pluggable Authentication Modules (PAM) interface. No calls to dscl, security, or osascript. No spawned processes. Just a quiet, local credential check that leaves defenders with one fewer signal to spot. If the password is wrong, the prompt loops until it gets a correct one.
Once it has a verified password, PamStealer displays a fake error saying the file is damaged and cannot be installed — a tidy little decoy to stop the victim from realising anything has happened.
The malware also requests full disk access for the fake Maccy app and contains code targeting Ethereum accounts, suggesting whoever built this is after both broad credential harvesting and crypto wallets.
One other detail worth noting: the second stage deliberately holds back certain permission prompts, including the Full Disk Access request, for up to forty minutes after launch. The goal is to decouple its more visible activity from the initial infection, making it harder to correlate the two events.
Jamf's researchers put it plainly: this is what the evolution of commodity macOS stealers looks like. Quieter execution chains, native API usage, and careful timing designed to stay beneath the threshold of typical detection. PamStealer is not a sophisticated nation-state tool, but it is a meaningful step up from the average infostealer, and that gap is worth paying attention to.