PamStealer macOS Malware: How It Steals Passwords Using Apple's PAM and What to Do
PamStealer is a two stage macOS infostealer first documented by Jamf Threat Labs on July 2, 2026, that uses Apple's Pluggable Authentication Modules (PAM) to verify stolen passwords locally — discarding typos and ensu...
Published byEdited with DeepSeek-V4-FlashImages generated with GPT Image 1.5
PamStealer is a two stage macOS infostealer first documented by Jamf Threat Labs on July 2, 2026, that uses Apple's Pluggable Authentication Modules (PAM) to verify stolen passwords locally — discarding typos and ensu...
Search & fact-check with cited sources for What is PamStealer — the new macOS infostealer that validates stolen passwords through Apple's PAPamStealer uses a typosquatting domain to impersonate the Maccy clipboard manager, tricking users into running malicious AppleScript code.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: Search & fact-check with cited sources for What is PamStealer — the new macOS infostealer that validates stolen passwords through Apple's PA. Article summary: Here is the full fact-checked breakdown based on the Jamf Threat Labs report (July 2, 2026) and corroborating sources.. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clickbait thumbnails, icons, and tiny thumbnail layouts. Make it useful as an illustrative
openai.com
A new macOS infostealer called PamStealer is making the rounds — and it has a particularly nasty trick up its sleeve. Instead of blindly accepting whatever password a victim types into a fake dialog box, it validates the password against Apple's own Pluggable Authentication Modules (PAM) before exfiltrating it. This means attackers only get working credentials, not typos or decoys. First documented by Jamf Threat Labs on July 2, 2026 , PamStealer represents a worrying evolution in macOS credential theft.
How PamStealer Infects Victims Via Typosquatting
The malware is distributed from a typosquat domain — maccyapp[.]com — designed to impersonate the legitimate Maccy clipboard manager project. The real Maccy is only distributed from , Homebrew, or its official GitHub repository . The legitimate site explicitly warns users about these copycat pages .
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "PamStealer macOS Malware: How It Steals Passwords Using Apple's PAM and What to Do"?
PamStealer is a two stage macOS infostealer first documented by Jamf Threat Labs on July 2, 2026, that uses Apple's Pluggable Authentication Modules (PAM) to verify stolen passwords locally — discarding typos and ensu...
PamStealer macOS Malware: How It Steals Passwords Using Apple's PAM and What to Do
PamStealer is a two stage macOS infostealer first documented by Jamf Threat Labs on July 2, 2026, that uses Apple's Pluggable Authentication Modules (PAM) to verify stolen passwords locally — discarding typos and ensu...
Published byEdited with DeepSeek-V4-FlashImages generated with GPT Image 1.5
PamStealer is a two stage macOS infostealer first documented by Jamf Threat Labs on July 2, 2026, that uses Apple's Pluggable Authentication Modules (PAM) to verify stolen passwords locally — discarding typos and ensu...
Search & fact-check with cited sources for What is PamStealer — the new macOS infostealer that validates stolen passwords through Apple's PAPamStealer uses a typosquatting domain to impersonate the Maccy clipboard manager, tricking users into running malicious AppleScript code.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: Search & fact-check with cited sources for What is PamStealer — the new macOS infostealer that validates stolen passwords through Apple's PA. Article summary: Here is the full fact-checked breakdown based on the Jamf Threat Labs report (July 2, 2026) and corroborating sources.. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clickbait thumbnails, icons, and tiny thumbnail layouts. Make it useful as an illustrative
openai.com
A new macOS infostealer called PamStealer is making the rounds — and it has a particularly nasty trick up its sleeve. Instead of blindly accepting whatever password a victim types into a fake dialog box, it validates the password against Apple's own Pluggable Authentication Modules (PAM) before exfiltrating it. This means attackers only get working credentials, not typos or decoys. First documented by Jamf Threat Labs on July 2, 2026 , PamStealer represents a worrying evolution in macOS credential theft.
How PamStealer Infects Victims Via Typosquatting
The malware is distributed from a typosquat domain — maccyapp[.]com — designed to impersonate the legitimate Maccy clipboard manager project. The real Maccy is only distributed from , Homebrew, or its official GitHub repository . The legitimate site explicitly warns users about these copycat pages .
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "PamStealer macOS Malware: How It Steals Passwords Using Apple's PAM and What to Do"?
PamStealer is a two stage macOS infostealer first documented by Jamf Threat Labs on July 2, 2026, that uses Apple's Pluggable Authentication Modules (PAM) to verify stolen passwords locally — discarding typos and ensu...
When a victim visits the fake site, they are served a disk image (.dmg) containing a compiled AppleScript file named Maccy.scpt. Legitimate Maccy has never distributed a DMG; it ships only as Maccy.app.zip.
When double-clicked, macOS opens .scpt files in Script Editor by design. The visible portion of the file shows branded instructions telling the user to press ⌘+R to "get started," while the actual malicious code is hidden far below after a large block of empty lines . The text also uses Greek and Cyrillic homoglyphs in the word "Maccy" to defeat text-based scanners .
What Data Does PamStealer Steal?
The second-stage Rust-based Mach-O infostealer collects a broad range of sensitive data :
Login password — captured via a native NSAlert dialog that reads "Maccy wants to make changes. Enter your password to allow this," then validated locally through PAM (pam_start, pam_authenticate, pam_end) with no visible shell activity .
Keychain entries — loads Security.framework at runtime (not in the static import table) to pull passwords from the macOS Keychain .
Browser credentials, cookies, and wallet extension data — opens credential databases directly using bundled SQLite read calls .
Clipboard contents — repeatedly runs the built-in pbpaste utility to monitor and exfiltrate whatever the user copies .
Full Disk Access targets — if the user later grants FDA (prompted after a delay of up to 40 minutes), protected files become accessible as well .
Cryptocurrency wallet reconnaissance — the C2 configuration includes Ethereum JSON-RPC endpoints, and the malware has been observed connecting to ethereum-rpc.publicnode[.]com in practice .
All stolen data is encrypted with ChaCha20-Poly1305 and exfiltrated over HTTPS to C2 endpoints (observed domains: avenger-sync[.]live and avengerflow[.]com), wrapped in a MacOSapp1{"data":"..."} JSON envelope .
Infection Indicators (IOCs)
Script Editor Code-Signing Triggers
Before launching the payload, the dropper ad-hoc signs the fake application bundle with codesign -fs - --deep (not a legitimate Developer ID signature), then launches it hidden with no window or Dock presence . The malware also checks for debugging tools and System Integrity Protection before proceeding .
Fake "Finder" Process Using pbpaste
The second-stage payload is placed inside a bundle named Finder.app with the bundle identifier com.apple.finder.monitor and the genuine Finder.icns icon copied from /System/Library/CoreServices/. It then spawns pbpaste to steal clipboard data, so Activity Monitor may show a second Finder process performing clipboard reads — a strong anomaly .
New Login Items With Copied System Icons
Persistence is established via Login Items (not LaunchAgents/LaunchDaemons) using both the modern SMAppService API and the legacy LSSharedFileList API, with the malware bundled inside: com.apple.finder.monitor and com.apple.security.daemon (masquerading as Software Update) . Because the Login Items pane in System Settings does not show full paths, the malware appears as legitimate system entries .
Other Indicators
A marker file named .Maccy is dropped alongside the staged bundle .
The dropper executes a JavaScript for Automation (JXA) payload via native ObjC APIs (NSURLSession), producing fewer process-creation artifacts than typical curl/osascript-based downloaders .
Geo-fencing: execution aborts if the timezone, locale, keyboard layout, or country code matches Russia, Belarus, Kazakhstan, or 8 other CIS countries .
How Users Can Stay Safe
Download Maccy only from the legitimate domain maccy.app, or via Homebrew / the official GitHub repository. The real project is open-source (MIT license) and run by developer Alexey Rodionov (Team Identifier MN3X4648SC) .
Never open .scpt files in Script Editor from a downloaded disk image and press Run. No legitimate macOS app asks you to do this .
Scrutinize unexpected admin password prompts. PamStealer's dialog reads "Maccy wants to make changes" — but a real app would not need your password to install a clipboard manager from its official source .
Be suspicious of delayed Full Disk Access requests. If an app asks for FDA 30–40 minutes after installation for no obvious reason, it is likely malware waiting to evade attribution .
Check Login Items in System Settings → General → Login Items for suspicious entries named after system components (e.g., com.apple.finder.monitor) that you did not intentionally add .
Monitor for multiple Finder processes in Activity Monitor, especially one that does not have a visible window .
When a victim visits the fake site, they are served a disk image (.dmg) containing a compiled AppleScript file named Maccy.scpt. Legitimate Maccy has never distributed a DMG; it ships only as Maccy.app.zip.
When double-clicked, macOS opens .scpt files in Script Editor by design. The visible portion of the file shows branded instructions telling the user to press ⌘+R to "get started," while the actual malicious code is hidden far below after a large block of empty lines . The text also uses Greek and Cyrillic homoglyphs in the word "Maccy" to defeat text-based scanners .
What Data Does PamStealer Steal?
The second-stage Rust-based Mach-O infostealer collects a broad range of sensitive data :
Login password — captured via a native NSAlert dialog that reads "Maccy wants to make changes. Enter your password to allow this," then validated locally through PAM (pam_start, pam_authenticate, pam_end) with no visible shell activity .
Keychain entries — loads Security.framework at runtime (not in the static import table) to pull passwords from the macOS Keychain .
Browser credentials, cookies, and wallet extension data — opens credential databases directly using bundled SQLite read calls .
Clipboard contents — repeatedly runs the built-in pbpaste utility to monitor and exfiltrate whatever the user copies .
Full Disk Access targets — if the user later grants FDA (prompted after a delay of up to 40 minutes), protected files become accessible as well .
Cryptocurrency wallet reconnaissance — the C2 configuration includes Ethereum JSON-RPC endpoints, and the malware has been observed connecting to ethereum-rpc.publicnode[.]com in practice .
All stolen data is encrypted with ChaCha20-Poly1305 and exfiltrated over HTTPS to C2 endpoints (observed domains: avenger-sync[.]live and avengerflow[.]com), wrapped in a MacOSapp1{"data":"..."} JSON envelope .
Infection Indicators (IOCs)
Script Editor Code-Signing Triggers
Before launching the payload, the dropper ad-hoc signs the fake application bundle with codesign -fs - --deep (not a legitimate Developer ID signature), then launches it hidden with no window or Dock presence . The malware also checks for debugging tools and System Integrity Protection before proceeding .
Fake "Finder" Process Using pbpaste
The second-stage payload is placed inside a bundle named Finder.app with the bundle identifier com.apple.finder.monitor and the genuine Finder.icns icon copied from /System/Library/CoreServices/. It then spawns pbpaste to steal clipboard data, so Activity Monitor may show a second Finder process performing clipboard reads — a strong anomaly .
New Login Items With Copied System Icons
Persistence is established via Login Items (not LaunchAgents/LaunchDaemons) using both the modern SMAppService API and the legacy LSSharedFileList API, with the malware bundled inside: com.apple.finder.monitor and com.apple.security.daemon (masquerading as Software Update) . Because the Login Items pane in System Settings does not show full paths, the malware appears as legitimate system entries .
Other Indicators
A marker file named .Maccy is dropped alongside the staged bundle .
The dropper executes a JavaScript for Automation (JXA) payload via native ObjC APIs (NSURLSession), producing fewer process-creation artifacts than typical curl/osascript-based downloaders .
Geo-fencing: execution aborts if the timezone, locale, keyboard layout, or country code matches Russia, Belarus, Kazakhstan, or 8 other CIS countries .
How Users Can Stay Safe
Download Maccy only from the legitimate domain maccy.app, or via Homebrew / the official GitHub repository. The real project is open-source (MIT license) and run by developer Alexey Rodionov (Team Identifier MN3X4648SC) .
Never open .scpt files in Script Editor from a downloaded disk image and press Run. No legitimate macOS app asks you to do this .
Scrutinize unexpected admin password prompts. PamStealer's dialog reads "Maccy wants to make changes" — but a real app would not need your password to install a clipboard manager from its official source .
Be suspicious of delayed Full Disk Access requests. If an app asks for FDA 30–40 minutes after installation for no obvious reason, it is likely malware waiting to evade attribution .
Check Login Items in System Settings → General → Login Items for suspicious entries named after system components (e.g., com.apple.finder.monitor) that you did not intentionally add .
Monitor for multiple Finder processes in Activity Monitor, especially one that does not have a visible window .
jamf.comPamStealer: macOS Malware Posing as Clipboard Manager App
playtech.roPamStealer, noul malware care vânează parolele utilizatorilor de Mac: cum se ascunde într-o aplicație aparent inofensivă
maccyapp.comDownload Maccy 2.7.3 — Free Clipboard Manager for macOS
github.comGitHub - p0deje/Maccy: Lightweight clipboard manager for macOS