Researchers have identified a newly discovered macOS malware called PamStealer that demonstrates advanced techniques for stealing credentials while evading detection. The malware is delivered through a two-stage infection process, beginning with a disk image that impersonates Maccy, a legitimate clipboard management application for macOS systems.
The initial stage of the attack employs AppleScript compiled into the fake Maccy disk image. When users double-click the image, they receive a prompt instructing them to press Command-R, which executes hidden malicious code. This approach is designed to bypass com.apple.quarantine, a macOS security feature that typically provides warnings for downloaded executable files. Rather than using conventional shell commands, the AppleScript executes a self-contained JavaScript for Automation downloader that retrieves the second-stage payload using native Objective-C application programming interfaces.
The second stage consists of a Rust-based infostealer binary optimized for Apple’s processors. This is notable because Rust remains relatively uncommon for macOS credential theft malware, which typically relies on languages like Swift, Go, or Objective-C. The malware displays a fake password prompt designed to mimic a legitimate system authorization dialog, claiming that “Maccy wants to make changes” and requesting credentials. Once entered, PamStealer validates the password locally through macOS’s Pluggable Authentication Modules interface rather than spawning separate processes, creating a stealthier execution chain that is more difficult for security tools to detect.
The malware employs several deception tactics to minimize user suspicion. After successfully capturing credentials, it displays a message indicating the file is damaged and cannot be installed. The malware also requests full disk access privileges and contains code designed to access cryptocurrency accounts. Throughout execution, the second stage works to remain hidden by masquerading as Finder, encrypting command-and-control communications, and delaying certain requests such as full disk access prompts for extended periods to avoid correlation with the initial application launch.
Security researchers from Jamf noted that PamStealer represents an evolving threat landscape for macOS systems, combining recently emerging delivery methods with less familiar payloads and native implementation techniques that reduce traditional detection opportunities while maintaining compatibility with standard macOS features.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI