Jamf security researchers have identified a previously unknown malware variant targeting macOS systems, which they designated PamStealer. The malware employs a two-stage delivery mechanism designed to minimize detection while harvesting user credentials and other sensitive information.
The first stage of the attack arrives via a disk image file that impersonates Maccy, a legitimate clipboard manager application for macOS. This stage is constructed using AppleScript and employs several evasion techniques. When opened in the macOS Script Editor, the malicious code is obscured within the file structure. Rather than relying on typical command-line tools, the AppleScript executes a self-contained JavaScript for Automation downloader that retrieves the second-stage payload using native Objective-C APIs. Users are prompted to press Command-R, which triggers malicious code execution while bypassing the com.apple.quarantine attribute that normally warns users about downloaded executables.
The second stage consists of a Rust-based infostealer, an uncommon choice for macOS malware compared to languages like Swift, Go, or Objective-C. This component masquerades as system processes, including variations of Finder or Software Update applications, and encrypts its command-and-control communications. The payload delays certain requests, such as Full Disk Access prompts, for extended periods to avoid temporal correlation with system activity.
A distinctive feature of PamStealer is its approach to credential harvesting. The malware displays a system-resembling password prompt requesting authorization. Once the user enters their password, the malware validates it locally through macOS’s Pluggable Authentication Modules interface without spawning separate processes, creating a quieter execution chain that is harder for security tools to detect. If validation fails, the prompt reappears; upon success, the malware displays a false message indicating file corruption. The malware also attempts to access full disk privileges and contains code targeting cryptocurrency accounts.
Jamf researchers noted that PamStealer represents an evolution in macOS infostealer techniques, combining recently emerging delivery mechanisms with sophisticated payload implementation and native system calls that reduce traditional detection opportunities while maintaining compatibility with standard macOS features.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI