PamStealer macOS Malware: How It Steals Passwords Using Apple's PAM and What to Do

A new macOS infostealer called PamStealer is making the rounds — and it has a particularly nasty trick up its sleeve. Instead of blindly accepting whatever password a victim types into a fake dialog box, it validates the password against Apple's own Pluggable Authentication Modules (PAM) before exfiltrating it. This means attackers only get working credentials, not typos or decoys. First documented by Jamf Threat Labs on July 2, 2026 ^JP, PamStealer represents a worrying evolution in macOS credential theft.

How PamStealer Infects Victims Via Typosquatting

The malware is distributed from a typosquat domain — maccyapp[.]com — designed to impersonate the legitimate Maccy clipboard manager project. The real Maccy is only distributed from maccy.app, Homebrew, or its official GitHub repository ^MG. The legitimate site explicitly warns users about these copycat pages ^F.

When a victim visits the fake site, they are served a disk image (.dmg) containing a compiled AppleScript file named Maccy.scpt ^JP. Legitimate Maccy has never distributed a DMG; it ships only as Maccy.app.zip ^P.

When double-clicked, macOS opens .scpt files in Script Editor by design. The visible portion of the file shows branded instructions telling the user to press ⌘+R to "get started," while the actual malicious code is hidden far below after a large block of empty lines ^JP. The text also uses Greek and Cyrillic homoglyphs in the word "Maccy" to defeat text-based scanners ^JF.

What Data Does PamStealer Steal?

The second-stage Rust-based Mach-O infostealer collects a broad range of sensitive data ^J:

• Login password — captured via a native NSAlert dialog that reads "Maccy wants to make changes. Enter your password to allow this," then validated locally through PAM (pam_start, pam_authenticate, pam_end) with no visible shell activity ^J.
• Keychain entries — loads Security.framework at runtime (not in the static import table) to pull passwords from the macOS Keychain ^J.
• Browser credentials, cookies, and wallet extension data — opens credential databases directly using bundled SQLite read calls ^J.
• Clipboard contents — repeatedly runs the built-in pbpaste utility to monitor and exfiltrate whatever the user copies ^JF.
• Full Disk Access targets — if the user later grants FDA (prompted after a delay of up to 40 minutes), protected files become accessible as well ^F.
• Cryptocurrency wallet reconnaissance — the C2 configuration includes Ethereum JSON-RPC endpoints, and the malware has been observed connecting to ethereum-rpc.publicnode[.]com in practice ^J.

All stolen data is encrypted with ChaCha20-Poly1305 and exfiltrated over HTTPS to C2 endpoints (observed domains: avenger-sync[.]live and avengerflow[.]com), wrapped in a MacOSapp1{"data":"..."} JSON envelope ^JP.

Infection Indicators (IOCs)

Script Editor Code-Signing Triggers

Before launching the payload, the dropper ad-hoc signs the fake application bundle with codesign -fs - --deep (not a legitimate Developer ID signature), then launches it hidden with no window or Dock presence ^J. The malware also checks for debugging tools and System Integrity Protection before proceeding ^F.

Fake "Finder" Process Using pbpaste

The second-stage payload is placed inside a bundle named Finder.app with the bundle identifier com.apple.finder.monitor and the genuine Finder.icns icon copied from /System/Library/CoreServices/ ^JP. It then spawns pbpaste to steal clipboard data, so Activity Monitor may show a second Finder process performing clipboard reads — a strong anomaly ^J.

New Login Items With Copied System Icons

Persistence is established via Login Items (not LaunchAgents/LaunchDaemons) using both the modern SMAppService API and the legacy LSSharedFileList API, with the malware bundled inside: com.apple.finder.monitor and com.apple.security.daemon (masquerading as Software Update) ^JPF. Because the Login Items pane in System Settings does not show full paths, the malware appears as legitimate system entries ^PT.

Other Indicators

• A marker file named .Maccy is dropped alongside the staged bundle ^J.
• The dropper executes a JavaScript for Automation (JXA) payload via native ObjC APIs (NSURLSession), producing fewer process-creation artifacts than typical curl/osascript-based downloaders ^J.
• Geo-fencing: execution aborts if the timezone, locale, keyboard layout, or country code matches Russia, Belarus, Kazakhstan, or 8 other CIS countries ^JP.

How Users Can Stay Safe

• Download Maccy only from the legitimate domain maccy.app, or via Homebrew / the official GitHub repository. The real project is open-source (MIT license) and run by developer Alexey Rodionov (Team Identifier MN3X4648SC) ^JP.
• Never open .scpt files in Script Editor from a downloaded disk image and press Run. No legitimate macOS app asks you to do this ^JF.
• Scrutinize unexpected admin password prompts. PamStealer's dialog reads "Maccy wants to make changes" — but a real app would not need your password to install a clipboard manager from its official source ^J.
• Be suspicious of delayed Full Disk Access requests. If an app asks for FDA 30–40 minutes after installation for no obvious reason, it is likely malware waiting to evade attribution ^F.
• Check Login Items in System Settings → General → Login Items for suspicious entries named after system components (e.g., com.apple.finder.monitor) that you did not intentionally add ^PJ.
• Monitor for multiple Finder processes in Activity Monitor, especially one that does not have a visible window ^J.