A newly identified piece of macOS malware called PamStealer demonstrates increasingly sophisticated methods for compromising Mac systems and harvesting user credentials, according to findings from Jamf, a security firm specializing in macOS protection.
The malware operates through a two-stage delivery mechanism. The initial stage arrives as a disk image disguised as Maccy, a legitimate clipboard management application for macOS. This stage is constructed using AppleScript and employs several techniques designed to bypass standard security measures, including a command that circumvents the com.apple.quarantine attribute that typically warns users about downloaded executable files.
The second stage payload represents a less common development choice for macOS malware, written in Rust rather than the more typical Swift, Go, or Objective-C languages. This component executes using native system APIs and includes functionality designed to remain undetected by masquerading as the Finder application and encrypting its communications. The malware also delays certain security prompts by up to forty minutes to avoid correlating its activities with the initial launch event.
PamStealer employs a distinctive approach to credential harvesting that sets it apart from comparable threats. When users interact with the malware, a prompt appears requesting a password that resembles an authentic system authorization dialog. Rather than using typical spawned processes to verify the entered password, the malware validates credentials locally through macOS’s Pluggable Authentication Modules interface, reducing the likelihood of detection. If validation fails, the malware repeatedly prompts for the password until receiving the correct one, then displays a misleading message indicating the installation failed.
The discovery illustrates the evolving nature of macOS-targeted threats, with attackers increasingly adopting quieter execution chains and native implementations that exploit standard macOS features while remaining difficult for security tools to identify. The malware includes additional capabilities such as requesting full disk access permissions and code designed to access cryptocurrency accounts, demonstrating efforts to maximize the scope of information extraction from compromised systems.