PamStealer macOS Malware Steals Login Passwords via Fake Maccy Sites

A new macOS information stealer dubbed PamStealer has been identified by Jamf Threat Labs, employing a multi-stage infection chain designed to harvest login credentials, browser data, and cryptocurrency assets. The malware masquerades as Maccy, a legitimate open-source clipboard manager, and is distributed through a lookalike domain ("maccyapp[.]com") mimicking the authentic site ("maccy[.]app"). Its name derives from its use of macOS Pluggable Authentication Modules (PAM) to locally validate a victim's login password before exfiltrating it to attacker-controlled servers.

The attack begins with a disk image containing a compiled AppleScript file ("Maccy.scpt") that conceals a JavaScript for Automation (JXA) downloader beneath hundreds of blank lines. When the victim opens the file in Script Editor and runs it—either via the Run button or the ⌘+R keyboard shortcut—the hidden payload executes and stages a secondary Rust-based Mach-O binary disguised as the Finder application. According to Jamf researcher Thijs Xhaflaire, this approach effectively sidesteps Apple's tightening Gatekeeper and Terminal protections because the script retains the com.apple.quarantine attribute yet still runs within the Script Editor context. Users concerned about credential exposure can verify their status using an email breach checker to confirm whether their accounts have surfaced in known dumps.

PamStealer incorporates several environment-aware defenses that raise the sophistication bar. The dropper derives a decryption key from a host fingerprint comprising CPU architecture, locale, keyboard layout, and timezone—failing on Intel Macs and terminating automatically on systems located in Eastern European countries including Russia, Belarus, Kazakhstan, Georgia, and Moldova. Once the Rust payload executes, it validates any supplied password against the local PAM stack before transmitting it, a technique that reduces network noise and helps the malware blend in with legitimate authentication traffic. Given the password-centric nature of this attack, users should run a password checker against their existing credentials and adopt unique, high-entropy passphrases managed through a reputable password manager.

The macOS threat landscape continues to evolve beyond traditional commodity stealers. The combination of a compiled AppleScript dropper, Apple Silicon-only execution, a Rust-based second stage, and PAM-validated credential capture makes PamStealer notably stealthier than typical macOS malware families. Security teams are advised to block the "maccyapp[.]com" infrastructure, monitor for unsigned .scpt executions launched from disk images, and inspect outbound connections from Mach-O binaries masquerading as system applications such as Finder.