CrashStealer and PamStealer: The New macOS Infostealers That Bypass Apple's Defenses

Gatekeeper bypass via notarized dropper. The infection chain starts with a first-stage application called Werkbit — a signed, Apple-notarized app carrying a valid Developer ID associated with "Emil Grigorov" . Because Apple's notary service approved it, Gatekeeper treats it as trusted and does not show the usual "unidentified developer" warning . Once the user manually downloads and opens Werkbit, a script downloads the real CrashStealer payload in the background .

Credentials and data targeted. CrashStealer harvests broadly across the system:

• Browser credentials from Chrome, Firefox, Edge, Brave, Opera, and Vivaldi .
• Approximately 14 password managers, including 1Password .
• Roughly 80 cryptocurrency wallet browser extensions and local wallet files .
• macOS Keychain data and system passwords .

Key techniques.

• Local password validation before exfiltration. CrashStealer prompts the user for their Mac login password through a fake system dialog styled like Apple's legitimate prompt, then validates it locally before proceeding to steal data — ensuring the attacker gets a working credential .
• AES-GCM encryption of stolen files before sending them to a remote command-and-control (C2) server, making network-level detection harder .
• Persistence and disguise. After infection, it presents a convincing fake crash reporter screen to maintain the masquerade, copies itself to ~/Library/Caches/com.apple.crashreporter/, and creates a LaunchAgent named com.apple.crashreporter.helper to survive reboots .
• The malware also requests "Full Disk Access" permissions to broaden what it can steal .

Apple's response. Apple revoked Werkbit's signing certificate after Jamf reported the malware .

PamStealer: A Rust-Based Stealer That Validates Passwords Through Apple's Own PAM API

What it is. PamStealer is a Rust-based, two-stage macOS infostealer disclosed by Jamf on July 2, 2026 . Its name comes from its novel use of Apple's Pluggable Authentication Modules (PAM) API to verify stolen passwords .

Distribution and Gatekeeper evasion. PamStealer is served from typosquatted domains impersonating the legitimate Maccy clipboard manager (e.g., maccyapp[.]com) . The attack bypasses Gatekeeper through a known but unpatched gap in macOS Script Editor:

• The victim downloads a trojanized disk image containing a compiled .scpt AppleScript file .
• The lure instructs the user to open the file in Script Editor and press Command-R to run it .
• Because Script Editor is a trusted system application, Gatekeeper's com.apple.quarantine protections are bypassed, and no warning is shown .

Credentials and data targeted. The second-stage Rust payload steals:

• macOS login passwords (via PAM) and the local admin password .
• Browser-saved credentials, cookies, and clipboard contents .
• macOS Keychain contents .
• Ethereum wallet files and SSH keys .

Key technique — PAM-based password validation. This is PamStealer's signature innovation:

• When macOS presents a standard auth prompt ("Maccy wants to make changes"), the user types their password .
• Instead of blindly capturing it, PamStealer calls Apple's own PAM API (pam_start, pam_authenticate) to test the password against the system's authentication stack before recording it .
• If the password is correct, it exfiltrates it and proceeds to harvest other credentials. If not, it can prompt again or abort, reducing the risk of wasting resources on a bad credential .
• This technique leaves fewer forensic traces than typical keyloggers or memory scrapers because it uses Apple's own API for verification rather than hooking system calls or reading memory buffers .

Broader Implications for Mac Malware Threats

• Notarization as a weapon. CrashStealer demonstrates that threat actors can successfully submit malicious apps to Apple's notary service and obtain Gatekeeper-passing signatures . Apple's revocation process is reactive, not preventive — the malware can spread for days or weeks before the certificate is revoked. This follows a pattern seen with earlier malware like MacSync and the Odyssey Stealer family, which also abused valid Apple developer signatures .

• Script Editor as a blind spot. Both PamStealer and a growing number of recent macOS threats exploit the fact that running AppleScripts through trusted system applications bypasses Gatekeeper entirely. Jamf notes this is a documented but still-unpatched gap .

• Mac infostealers are getting sophisticated. The use of AES-GCM encryption for exfiltrated data (CrashStealer) and PAM API validation (PamStealer) shows attackers investing in custom, stealthy tradecraft rather than relying on commodity malware . Microsoft also noted in February 2026 a broader trend of macOS, Python, and cross-platform infostealers using "ClickFix" social-engineering lures to steal browser passwords, crypto wallets, and cloud credentials .

• Password validation on-device is a new reliability boost. Rather than guessing or bulk-collecting credentials, both of these stealers confirm the password is valid on the victim's machine before exfiltration — improving the attacker's success rate and reducing the chance of detection from failed logins . This is a meaningful evolution: typical infostealers either capture whatever is typed or use techniques like dscl or security command calls that may fail silently or trigger alerts .