Security researchers at Jamf have identified a previously undocumented macOS malware strain called PamStealer that employs a sophisticated multi-stage delivery mechanism and credential-stealing capabilities. The discovery reflects a broader trend of increased development effort directed toward creating infostealers targeting Apple’s operating system.
The malware operates through a two-stage infection process. The initial stage arrives as a disk image designed to mimic Maccy, a legitimate clipboard management utility for macOS. This first component is compiled as AppleScript code, which serves as the delivery mechanism for the second stage payload. The malware’s name derives from its use of the Pluggable Authentication Modules interface built into macOS to validate user login credentials before transmitting them to attacker-controlled infrastructure.
While disk image and AppleScript-based delivery methods are established techniques in macOS malware distribution, PamStealer distinguishes itself through its approach to avoiding detection. Rather than employing standard shell commands, the AppleScript executes a self-contained JavaScript for Automation downloader that uses native Objective-C APIs to retrieve and stage the payload. This execution chain generates less suspicious system activity than typical commodity macOS stealers. When users double-click the disk image expecting to install a clipboard manager, they are prompted to press Command-R, which executes malicious code while also bypassing com.apple.quarantine, a macOS security attribute that typically provides warnings for downloaded executables.
The second-stage payload is a Mach-O binary written in Rust, an uncommon language choice for macOS infostealers compared to Swift, Go, or Objective-C. This component masquerades as either Finder or Software Update components and encrypts its command-and-control communications. The malware displays a fake system authorization prompt requesting the user’s password. Once entered, PamStealer validates the credentials locally through the PAM API rather than spawning external processes, resulting in reduced forensic detectability. If validation fails, the prompt reappears until the correct password is provided. Upon successful credential capture, the malware displays a message claiming the file is damaged, serving as a decoy to prevent user suspicion.
The malware incorporates additional tactics to maximize data theft, including requests for full disk access permissions and code designed to access cryptocurrency accounts. Jamf researchers noted that PamStealer’s combination of techniques—particularly the Script Editor integration, self-contained JavaScript downloader, Rust-based second stage, and local credential validation through PAM—demonstrates how commodity macOS stealers continue to evolve with quieter execution chains and native implementations that reduce traditional detection opportunities.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI