Security researchers at Jamf Threat Labs have uncovered a sophisticated new piece of macOS malware that employs an unusually stealthy approach to credential theft. Dubbed “PamStealer,” the malware uses macOS’s built-in Pluggable Authentication Modules (PAM) interface to locally validate stolen passwords before exfiltration, setting it apart from typical macOS infostealers.
PamStealer is delivered in two stages. The first stage arrives as a compiled AppleScript (.scpt) file inside a disk image that masquerades as Maccy, a legitimate open-source clipboard manager for macOS. When a user double-clicks the file, it opens in Script Editor, where the malicious functionality is buried deep within the file behind a block of empty lines.
The social engineering is convincing: the script displays instructions to press Command-R (or click Run), which executes embedded code. Notably, this works even when the file carries the com.apple.quarantine attribute, allowing it to bypass Gatekeeper warnings.
“Rather than relying on shell commands such as curl or zsh, the AppleScript executes a self-contained JavaScript for Automation downloader that retrieves and stages the payload using native Objective-C APIs,” Jamf researchers explained. The dropper is hosted on the fake domain maccyapp[.]com, impersonating the legitimate project.
What makes PamStealer particularly clever is its environment-aware execution. The dropper derives a key from a fingerprint of the host — CPU architecture, locale, keyboard layout, and time zone — and uses it to unlock an encrypted, integrity-checked configuration. In analyzed samples, it was keyed to Apple Silicon; on Intel hosts, it silently terminates.
The malware also checks against an exclusion list using three independent signals: time zone, country identifiers, and keyboard input sources. Systems in or near Russia and neighboring countries are excluded, suggesting a targeted campaign.
The second stage is a Rust-based Mach-O binary that acts as the infostealer. Rust is relatively uncommon among macOS stealers, which typically use Swift, Go, or Objective-C. The malware displays a native password prompt that reads “Maccy wants to make changes. Enter your password to allow this.”
“This check is done entirely through PAM: there is no call out to dscl, security, osascript or any spawned process to verify the password, as many commodity macOS stealers do,” Jamf said. “The result is a quieter routine that keeps only a verified password, and one fewer process chain for defenders to detect on.”
If validation fails, the malware repeats the prompt until it receives the correct password, then displays a decoy message that the file is damaged and can’t be installed. It also requests Full Disk Access and contains code to access Ethereum accounts.
“Together, these behaviors illustrate how commodity macOS stealers continue to evolve, adopting quieter execution chains and native implementations that reduce traditional detection opportunities,” Jamf noted.
PamStealer was covered by Ars Technica and highlights the ongoing arms race between macOS security features and malware developers who increasingly adopt Rust, JXA-based droppers, and system-level API abuse to stay undetected.
