Executive Summary
Jamf Threat Labs has identified a new macOS malware family dubbed 'PamStealer', which is currently distributed via a fake website (maccyapp[.]com) impersonating the legitimate Maccy clipboard manager. The attack chain begins with a malicious disk image containing a compiled AppleScript (.scpt). This script uses JavaScript for Automation (JXA) to download a second-stage Rust-based Mach-O binary that performs extensive data theft.
Technically, PamStealer is notable for its use of the Pluggable Authentication Modules (PAM) framework to locally validate stolen user passwords, ensuring only correct credentials are exfiltrated. It employs sophisticated evasion techniques, including environment-aware execution that checks for specific locales (targeting non-CIS regions) and host fingerprints. Persistence is achieved through both modern ServiceManagement APIs and legacy login item modifications using an embedded helper binary.
This threat highlights the increasing maturity of macOS-targeted malware, specifically the shift toward Rust for cross-platform evasion and the use of native Objective-C APIs within AppleScript to minimize behavioral footprints. Organizations should monitor for unusual network activity from Script Editor and unauthorized additions to login items.