PamStealer: New macOS Malware Verifies Passwords Before Theft

A newly discovered macOS infostealer, dubbed PamStealer, distinguishes itself with a highly insidious tactic: it verifies Mac login passwords through Apple's Pluggable Authentication Modules (PAM) *before* exfiltrating any sensitive data. This unique capability gives attackers immediate confirmation that stolen credentials are valid, significantly increasing their value and the potential for successful follow-on attacks.

Uncovered by Jamf Threat Labs, PamStealer operates through a sophisticated, multi-stage attack chain. It initially masquerades as the popular Maccy clipboard manager, luring victims via fake websites that distribute a malicious AppleScript application. Once executed, this script deploys a second-stage payload written in Rust, a language known for making reverse engineering more difficult. The malware then proceeds to harvest a wide array of information, including browser cookies, browsing history, saved credentials, SQLite databases, clipboard contents, and cryptocurrency wallet data. To maintain persistence, PamStealer creates login items using both modern and legacy macOS mechanisms and even impersonates Finder to solicit Full Disk Access, further expanding its reach. Its stealth is enhanced by encrypting command-and-control traffic and strategically delaying permission prompts for up to 40 minutes to avoid immediate suspicion.

The emergence of PamStealer underscores a troubling trend: the macOS threat landscape is no longer a niche for unsophisticated actors. Infostealers targeting Mac users have surged in both prevalence and complexity, driven by macOS's growing market share and the lucrative nature of stolen credentials. Threat actors are increasingly investing in advanced tradecraft, leveraging legitimate operating system features and multi-stage delivery to evade detection. This shift necessitates a re-evaluation of macOS security, moving beyond a reliance on reputation alone. Users must adopt heightened vigilance, scrutinizing software sources and recognizing that social engineering, not just technical exploits, remains the primary vector for these evolving threats.