macOS PamStealer loads libpam via non-system binary after xpcproxy sandbox launch

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•0

Detects the execution of an unsigned, non-Apple binary initiated via xpcproxy that subsequently loads 'libpam.2.dylib' within a two-minute window. This behavior is indicative of a PamStealer-style attack, where a malicious or spoofed process attempts to harvest user credentials by leveraging system PAM libraries for validation.