Security researchers at Jamf Threat Labs report a new macOS credential-stealing malware, dubbed PamStealer, that impersonates the legitimate open-source Maccy clipboard manager. The campaign starts with a decoy delivery that closely mimics Maccy, which then provides a malicious AppleScript-based payload disguised as the clipboard app. According to multiple reports, PamStealer uses a two-stage design in which the initial component delivers a second-stage infostealer written in Rust.
A key feature highlighted across sources is how PamStealer handles passwords. Instead of simply capturing whatever password a victim types, it verifies the provided Mac login password locally using macOS’s Pluggable Authentication Modules (PAM). Researchers describe the malware presenting a native-looking authorization prompt resembling a system request; if the password is correct, the malware proceeds, and if it fails, it prompts again until the correct password is entered. One report also describes decoy behavior intended to reduce suspicion after successful entry.
Jamf and other outlets add that the malware also seeks additional sensitive data beyond credentials, including requesting full disk access and containing functionality related to cryptocurrency accounts.
