PamStealer macOS Malware: How It Steals Passwords Using Apple's PAM and What to Do

When double-clicked, macOS opens .scpt files in Script Editor by design. The visible portion of the file shows branded instructions telling the user to press ⌘+R to "get started," while the actual malicious code is hidden far below after a large block of empty lines . The text also uses Greek and Cyrillic homoglyphs in the word "Maccy" to defeat text-based scanners .

What Data Does PamStealer Steal?

The second-stage Rust-based Mach-O infostealer collects a broad range of sensitive data :

• Login password — captured via a native NSAlert dialog that reads "Maccy wants to make changes. Enter your password to allow this," then validated locally through PAM (pam_start, pam_authenticate, pam_end) with no visible shell activity .
• Keychain entries — loads Security.framework at runtime (not in the static import table) to pull passwords from the macOS Keychain .
• Browser credentials, cookies, and wallet extension data — opens credential databases directly using bundled SQLite read calls .
• Clipboard contents — repeatedly runs the built-in pbpaste utility to monitor and exfiltrate whatever the user copies .
• Full Disk Access targets — if the user later grants FDA (prompted after a delay of up to 40 minutes), protected files become accessible as well .
• Cryptocurrency wallet reconnaissance — the C2 configuration includes Ethereum JSON-RPC endpoints, and the malware has been observed connecting to ethereum-rpc.publicnode[.]com in practice .

All stolen data is encrypted with ChaCha20-Poly1305 and exfiltrated over HTTPS to C2 endpoints (observed domains: avenger-sync[.]live and avengerflow[.]com), wrapped in a MacOSapp1{"data":"..."} JSON envelope .

Infection Indicators (IOCs)

Script Editor Code-Signing Triggers

Before launching the payload, the dropper ad-hoc signs the fake application bundle with

codesign -fs - --deep

Fake "Finder" Process Using pbpaste

The second-stage payload is placed inside a bundle named Finder.app with the bundle identifier com.apple.finder.monitor and the genuine Finder.icns icon copied from /System/Library/CoreServices/ . It then spawns pbpaste to steal clipboard data, so Activity Monitor may show a second Finder process performing clipboard reads — a strong anomaly .

New Login Items With Copied System Icons

Persistence is established via Login Items (not LaunchAgents/LaunchDaemons) using both the modern SMAppService API and the legacy LSSharedFileList API, with the malware bundled inside: com.apple.finder.monitor and com.apple.security.daemon (masquerading as Software Update) . Because the Login Items pane in System Settings does not show full paths, the malware appears as legitimate system entries .

Other Indicators

• A marker file named .Maccy is dropped alongside the staged bundle .
• The dropper executes a JavaScript for Automation (JXA) payload via native ObjC APIs (NSURLSession), producing fewer process-creation artifacts than typical curl/osascript-based downloaders .
• Geo-fencing: execution aborts if the timezone, locale, keyboard layout, or country code matches Russia, Belarus, Kazakhstan, or 8 other CIS countries .

How Users Can Stay Safe

• Download Maccy only from the legitimate domain maccy.app, or via Homebrew / the official GitHub repository. The real project is open-source (MIT license) and run by developer Alexey Rodionov (Team Identifier MN3X4648SC) .
• Never open .scpt files in Script Editor from a downloaded disk image and press Run. No legitimate macOS app asks you to do this .
• Scrutinize unexpected admin password prompts. PamStealer's dialog reads "Maccy wants to make changes" — but a real app would not need your password to install a clipboard manager from its official source .
• Be suspicious of delayed Full Disk Access requests. If an app asks for FDA 30–40 minutes after installation for no obvious reason, it is likely malware waiting to evade attribution .
• Check Login Items in System Settings → General → Login Items for suspicious entries named after system components (e.g., com.apple.finder.monitor) that you did not intentionally add .
• Monitor for multiple Finder processes in Activity Monitor, especially one that does not have a visible window .