- Published on
Newly discovered PamStealer isn't your typical macOS malware
- Authors
- Name
- DeepHorus
Researchers have discovered a novel macOS malware strain dubbed PamStealer that employs sophisticated stealth techniques to infect Macs and steal credentials. Named after its use of the Pluggable Authentication Modules (PAM) interface to validate stolen login passwords, the malware was identified by security firm Jamf and represents a significant evolution in macOS threat tradecraft.
The malware is delivered in two stages, beginning with a disk image that impersonates Maccy, a legitimate clipboard manager. When users double-click the disk image, they are prompted to press Command-R, which executes malicious AppleScript code directly. This technique bypasses com.apple.quarantine, a macOS security feature that warns about downloaded files. The AppleScript then runs a self-contained JavaScript for Automation (JXA) downloader that retrieves the second stage payload using native Objective-C APIs.
The second stage is a Rust-based infostealer that masquerades as legitimate system components like Finder or Software Update. It encrypts command-and-control traffic and delays requests for permissions such as Full Disk Access for up to forty minutes to avoid detection. The malware validates stolen passwords locally through PAM before exfiltrating them to attacker-controlled servers, ensuring only valid credentials are sent.
Jamf researchers highlighted the uniqueness of PamStealer's execution chain, noting that it combines a clickable .scpt file and Script Editor lure with a self-contained JXA dropper. This approach reduces reliance on shell commands like curl or zsh, making the malware quieter and harder to detect. The use of native macOS APIs and Rust further complicates traditional signature-based detection.
The implications for macOS users are concerning, as PamStealer demonstrates how commodity stealers continue to evolve with stealthier techniques. By mimicking trusted applications and delaying suspicious behavior, the malware can evade both automated security tools and user scrutiny. The credential theft capability poses risks for personal and enterprise users alike.
In response, Jamf recommends that macOS users exercise caution when downloading applications, especially clipboard managers or other utilities. Verifying the legitimacy of disk images and avoiding prompts to use keyboard shortcuts like Command-R can help mitigate infection. Security teams should monitor for unusual AppleScript activity and unexpected PAM validation requests.
Looking ahead, the emergence of PamStealer signals that macOS threats are becoming more sophisticated, leveraging native frameworks and programming languages like Rust. As attackers adopt quieter execution chains, defenders will need to rely on behavior-based detection and endpoint monitoring. This discovery underscores the importance of continuous vigilance in the macOS security landscape.
