PamStealer Exposes a Troubling New Era of Sophisticated Mac Credential Theft

A newly identified piece of macOS malware called PamStealer is drawing significant attention from the security community for its unusually sophisticated approach to stealing user credentials. Discovered by researchers at Jamf, a firm specializing in macOS security, the malware stands out not just for what it does but for how carefully it avoids detection while doing it. Rather than relying on the blunt, easily flagged techniques common to most Mac infostealers, PamStealer combines multiple layers of native macOS functionality to build what researchers describe as a notably quieter execution chain.

The attack begins when a victim downloads a disk image masquerading as Maccy, a well-known and trusted clipboard manager for macOS. Inside, an AppleScript file prompts the user to press Command-R immediately after double-clicking, which triggers the malicious payload while simultaneously bypassing the com.apple.quarantine attribute — the macOS safeguard that normally warns users about files downloaded from the internet. This single social engineering trick effectively sidesteps one of Apple's core user-facing protections before the victim realizes anything is wrong.

What makes PamStealer particularly distinctive is its use of Apple's Pluggable Authentication Modules, or PAM, to validate the stolen password locally before transmitting it to an attacker-controlled server. Most commodity macOS stealers rely on spawning external processes or calling tools like dscl or osascript to verify credentials, all of which leave detectable traces for defenders. PamStealer skips those entirely, validating the password in silence and only sending confirmed credentials — significantly reducing the forensic footprint left behind.

The second stage of the malware is a Rust-compiled binary, an unusual language choice for macOS infostealers, which more commonly appear in Swift, Go, or Objective-C. This stage impersonates legitimate macOS components like Finder.app and Software Update.app, complete with genuine Apple icons, and takes deliberate steps to delay suspicious behavior — such as withholding Full Disk Access permission requests for up to forty minutes after launch — so that its activity doesn't coincide with the initial infection event. It also encrypts its command-and-control traffic and reads browser database files directly through a bundled SQLite interface.

After extracting a verified password, PamStealer displays a fake error message claiming the installation file is corrupted and cannot proceed, a classic misdirection tactic designed to keep the victim unsuspecting. Beyond passwords, the malware also targets Ethereum cryptocurrency accounts and seeks to harvest as much stored data as possible. Jamf's researchers note that the combination of these techniques reflects a broader and accelerating trend of macOS-targeted malware becoming more technically mature and harder to catch with conventional defenses.