{"id":361146,"date":"2026-07-05T02:52:52","date_gmt":"2026-07-04T21:22:52","guid":{"rendered":"https:\/\/ebiztoday.news\/?p=361146"},"modified":"2026-07-05T02:52:52","modified_gmt":"2026-07-04T21:22:52","slug":"newly-discovered-pamstealer-is-not-your-typical-macos-malware","status":"publish","type":"post","link":"https:\/\/ebiztoday.news\/index.php\/2026\/07\/05\/newly-discovered-pamstealer-is-not-your-typical-macos-malware\/","title":{"rendered":"Newly discovered PamStealer is not your typical macOS malware"},"content":{"rendered":"
\n

Researchers have found a never-before-seen piece of macOS malware that mixes a series of clever tradecraft to contaminate Macs with stealthy, custom-developed credential-stealing code.<\/p>\n

The malware is delivered in two stages. The primary is distributed in a disk image that masquerades as Maccy<\/a>, a clipboard manager for Macs. It\u2019s compiled as AppleScript that’s notable for the way in which it delivers the second stage. The malware is known as PamStealer since the Rust-written infostealer uses the Pluggable Authentication Modules interface built into macOS to validate the goal\u2019s login password before sending it to an attacker-controlled server.<\/p>\n

A quieter execution chain<\/h2>\n

The usage of each disk image and AppleScript is common in malware for Macs. More odd is the way in which PamStealer combines them to achieve stealth. When the AppleScript is double-clicked, it\u2019s opened within the macOS Script Editor, where the malicious functionality is buried deep inside the file.<\/p>\n

\u201cSlightly than counting on shell commands resembling curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader that retrieves and stages the payload using native Objective-C APIs,\u201d researchers from Jamf, a security firm for macOS users, wrote<\/a>. \u201cCombined with a Rust-based second stage and a password capture workflow that validates credentials locally through PAM, the result’s a quieter execution chain than we typically observe in commodity macOS stealers.\u201d<\/p>\n

When a user, expecting to put in a trustworthy clipboard manager, encounters the disk image, they\u2019re prompted to press Command-R immediately after double-clicking it. This command executes malicious code contained in the AppleScript directly. It also allows the execution to bypass com.apple.quarantine, a macOS attribute that gives warnings and restrictions when executable files have been downloaded from the Web.<\/p>\n

As Jamf explained:<\/p>\n

\n

PamStealer combines a recently emerging delivery surface with a less familiar payload. While the clickable .scpt and Script Editor lure construct on tradecraft that’s already gaining adoption across the macOS threat landscape, the malware distinguishes itself through a self-contained JXA dropper, a Rust-based second stage, and a password capture workflow that validates credentials locally through PAM before harvesting them. That second stage puts considerable effort into staying hidden, masquerading as Finder, encrypting its command-and-control traffic, and holding back prompts just like the Full Disk Access request for so long as forty minutes so its activity doesn’t line up with launch. Together, these behaviors illustrate how commodity macOS stealers proceed to evolve, adopting quieter execution chains and native implementations that reduce traditional detection opportunities while remaining compatible with standard macOS features.<\/p>\n<\/blockquote>\n

The primary stage puts its payload inside an app bundle that impersonates real components built into macOS. The component changes from sample to sample of the malware. Finder.app under com.apple.finder.core or com.apple.finder.monitor, and a Software Update.app under com.apple.security.daemon, are two examples. In either case, they run hidden. In addition they display macOS\u2019s real Finder.icns as its icon.<\/p>\n<\/p><\/div>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Researchers have found a never-before-seen piece of macOS malware that mixes a series of clever tradecraft to contaminate Macs with stealthy, custom-developed credential-stealing code. The malware is delivered in two stages. The primary is distributed in a disk image that masquerades as Maccy, a clipboard manager for Macs. It\u2019s compiled as AppleScript that’s notable for […]<\/p>\n","protected":false},"author":1,"featured_media":361147,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[731,6299,13287,1645,10744,53522,11868],"class_list":["post-361146","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology","tag-discovered","tag-isnt","tag-macos","tag-malware","tag-newly","tag-pamstealer","tag-typical"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t