Threat reportMalwareTL-2026-1100
PamStealer: macOS Infostealer Distributed via Fake Maccy Sites Using PAM Password Validation
PamStealer: macOS Infostealer Distributed via Fake Maccy (TL-2026-1100), also tracked as Maccy Clipboard Manager Impersonation Campaign, is a high-severity malware campaign, first published 2026-07-03. It has no confirmed attribution, affects Apple macOS on Apple Silicon (arm64), maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 26MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-1100
- Threat ID
- TL-2026-1100
- Also known as
- Maccy Clipboard Manager Impersonation Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, cryptocurrency, individual-users, technology
- Target regions
- Global (excludes Russia, Belarus, Kazakhstan, Armenia, Azerbaijan, Kyrgyzstan, Moldova, Tajikistan, Uzbekistan, Turkmenistan, and Georgia via built-in exclusion checks)
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in PamStealer: macOS Infostealer Distributed via Fake Maccy
Malware and tooling: MacOSapp1, PamStealer, NSURLSession, Security.framework (runtime-loaded), avenger-config-v2
How PamStealer: macOS Infostealer Distributed via Fake Maccy works
Jamf Threat Labs identified PamStealer, a two-stage macOS infostealer distributed via the lookalike domain maccyapp[.]com impersonating the legitimate Maccy clipboard manager. A compiled AppleScript dropper stages a Rust-based Mach-O second stage that validates stolen login passwords through macOS PAM before harvesting browser credentials, cookies, cryptocurrency wallet data, and clipboard contents, then exfiltrates over an encrypted C2 channel.
PamStealer is a two-stage macOS credential- and cryptocurrency-theft campaign discovered by Jamf Threat Labs and corroborated by The Hacker News and multiple security outlets on 2026-07-02/03. Victims are lured to the typosquat domain maccyapp[.]com, a lookalike of the legitimate open-source clipboard manager maccy.app, and served a disk image containing a compiled AppleScript file (Maccy.scpt). Homoglyph (Greek/Cyrillic lookalike) characters are used within the on-disk 'Maccy' branding text to evade simple string-matching detection, and the victim is socially engineered to open the file in Script Editor and press Command+R to execute it.
Stage 1 is a compiled AppleScript wrapper around obfuscated JavaScript for Automation (JXA). Rather than shelling out to curl or other command-line utilities, it uses NSURLSession to download the second-stage payload, reducing the process-based telemetry defenders typically monitor. Before staging the payload it performs host-fingerprint-based encryption key derivation from CPU architecture, locale, keyboard layout, and timezone, runs anti-debugging checks and SIP status inspection, and aborts entirely on hosts whose locale, timezone, or keyboard layout indicates Russia, Belarus, Kazakhstan, Armenia, Azerbaijan, Kyrgyzstan, Moldova, Tajikistan, Uzbekistan, Turkmenistan, or Georgia. The staged payload is placed inside a masqueraded system app bundle at ~/Library/Application Support/com.apple.finder.core/Finder.app and given ad-hoc code signing (codesign -fs - --deep) rather than a Developer ID signature, satisfying Gatekeeper without needing a legitimate certificate.
Stage 2 is a stripped arm64-only Mach-O binary written in Rust -- an unusual implementation language for macOS stealers, which more commonly use Swift, Go, or Objective-C. Configuration keys fail to decrypt on Intel (x86_64) hardware, causing silent termination and effectively restricting the payload to Apple Silicon. Most strings are decrypted only at runtime to blunt static analysis. The binary bundles SQLite for direct database access to browser credential, cookie, and wallet-extension stores, and loads Security.framework dynamically at runtime (rather than linking it statically) to query the macOS Keychain -- keeping that capability off the binary's static import table. Clipboard contents are harvested by spawning the pbpaste utility from the masqueraded Finder process at irregular 10-90 second intervals.
The defining behavior that gives the malware its name is its password-validation routine: before treasuring a captured login password, PamStealer displays a native NSAlert with a secure text field styled to resemble a system authorization prompt ('Maccy wants to make changes. Enter your password to allow this', with the account name pre-filled), and validates whatever the victim types entirely through the local PAM API (pam_start, pam_authenticate, pam_end) -- with no external process spawned (no dscl, security, or osascript) and no network callout. If validation fails it re-prompts until the correct password is entered, guaranteeing that only a verified, working credential is exfiltrated.
Persistence uses the modern SMAppService API for login-item registration, with a legacy fallback: a 34 KB arm64 helper binary written to /private/tmp/System Settings that uses LSSharedFileListInsertItemURL against kLSSharedFileListSessionLoginItems to add the malicious bundle to login items directly. Separately, to gain the Full Disk Access needed for broader data collection, the malware displays a counterfeit system alert styled with the Finder icon claiming 'Finder' has lost access to protected data -- deliberately delayed 10 to 40 minutes after initial launch to break the temporal link to execution. Clicking 'Open Settings' takes the user directly to the Full Disk Access pane in System Settings, where the malicious bundle appears under the legitimate-looking name 'Finder.' This is purely a social-engineering TCC-permission grab; Jamf observed no exploit-based privilege escalation.
Stolen data is encrypted with ChaCha20-Poly1305 using runtime-generated keys that are never written to disk, wrapped in a '{"data":"..."}' JSON envelope preceded by the build marker string 'MacOSapp1', and POSTed as application/json to the C2 endpoint https://avenger-sync[.]live/api/sync, which is fronted by Cloudflare to obscure the true backend infrastructure. An internally-named configuration object, 'avenger-config-v2', embeds this C2 URL alongside two Ethereum JSON-RPC endpoints (eth.drpc.org and ethereum-rpc.publicnode[.]com), most likely used to query on-chain wallet balances and prioritize which crypto assets to steal. Forensic artifacts include the C2 URL stored in cleartext in a dropped .config file, a .lock file and a .Maccy marker file alongside the staged bundle, a network cache at ~/Library/Caches/com.apple.finder.core/Cache.db holding encrypted C2 exchanges and cleartext connection metadata, and Script Editor cache entries under ~/Library/Caches/com.apple.ScriptEditor2/.
No CVE applies -- this is a malware distribution and social-engineering campaign, not a software vulnerability. No attribution to a named threat actor or nation-state has been published by Jamf or any secondary source as of this writing; the regional exclusion list targeting post-Soviet/CIS territories and the financially-motivated theft of credentials and cryptocurrency are consistent with a financially-motivated cybercriminal operation rather than state-sponsored espionage, but this remains an assessment rather than a confirmed attribution.
MITRE ATT&CK techniques used in TL-2026-1100
Collection
T1005 Data from Local System; T1115 Clipboard Data
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
T1056 Input Capture; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1614 System Location Discovery
Initial Access
credential-access
T1539 Steal Web Session Cookie
Persistence
T1547 Boot or Logon Autostart Execution
privilege-escalation
T1548 Abuse Elevation Control Mechanism
defense-impairment
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities
Affected products and versions in PamStealer: macOS Infostealer Distributed via Fake Maccy
- Apple — macOS on Apple Silicon (arm64)
Vulnerable versions: All macOS versions running on Apple Silicon (arm64) hardware -- Intel (x86_64) hosts are not targeted; configuration keys fail to decrypt and the payload silently terminates - Maccy (open-source project, impersonated brand) — Maccy clipboard manager
Remediation for PamStealer: macOS Infostealer Distributed via Fake Maccy
Patches
- No vendor patch applicable -- this is a malware distribution and social-engineering campaign, not a software vulnerability in macOS or Maccy
Immediate actions
- Block the domains maccyapp[.]com and avenger-sync[.]live at DNS resolvers, secure web gateways, and perimeter firewalls
- Alert users/employees that the only legitimate source for the Maccy clipboard manager is maccy.app (and its official Homebrew/GitHub release channels) -- never maccyapp.com
- Hunt fleet-wide for masqueraded 'Finder.app' bundles under ~/Library/Application Support/com.apple.finder.core/ and for the helper binary at /private/tmp/System Settings
- Isolate and reimage any host where Script Editor was observed executing an ad-hoc-signed compiled AppleScript (.scpt) downloaded from outside the App Store
- Force credential resets and revoke active sessions for any user who entered their macOS login password into an unexpected 'Maccy wants to make changes' authorization-style prompt
Workarounds
- Restrict Script Editor / osascript execution for non-developer user populations via endpoint configuration policy
- Disable Gatekeeper acceptance of ad-hoc-signed (unsigned/self-signed) application bundles fleet-wide
- Block outbound HTTP/HTTPS traffic to avenger-sync[.]live and monitor for POST requests containing the JSON key pattern {"data":"..."} to unfamiliar destinations
Longer-term hardening
- Deploy MDM/EDR (e.g., Jamf Protect or an equivalent macOS-aware EDR) with behavioral detection rules for AppleScript/JXA droppers, ad-hoc code signing of app bundles staged outside standard install paths, and anomalous Full Disk Access grant requests
- Enforce application allow-listing and require Developer ID-signed, notarized applications; disable acceptance of ad-hoc-signed bundles on managed fleets
- Train users to recognize typosquatting and homoglyph lookalike domains for common utility/productivity apps before downloading disk images from search results or ads
- Monitor and alert on pbpaste being spawned by processes impersonating system applications (e.g., a 'Finder' process outside /System/Library/CoreServices)
- Review and restrict which processes are permitted to prompt for Full Disk Access via TCC, and audit TCC.db for unexpected grants shortly after unfamiliar bundle execution
Timeline of PamStealer: macOS Infostealer Distributed via Fake Maccy
- A counterfeit, Finder-styled Full Disk Access prompt is documented, deliberately delayed 10-40 minutes after launch to break the temporal link between it and initial execution; purely social-engineering, with no exploit-based privilege escalation observed.
- Persistence mechanisms documented: primary use of the SMAppService login-item API, with a legacy fallback 34 KB arm64 helper binary at /private/tmp/System Settings using LSSharedFileListInsertItemURL against kLSSharedFileListSessionLoginItems.
- C2 endpoint avenger-sync[.]live/api/sync identified, fronted by Cloudflare and using ChaCha20-Poly1305 encrypted, JSON-enveloped HTTP POST traffic with runtime-generated keys never written to disk.
- Jamf documents the namesake PAM-based local password validation routine (pam_start/pam_authenticate/pam_end), used via a spoofed NSAlert authorization prompt to confirm stolen credentials are correct before exfiltration.
- Stage 2 payload confirmed as a stripped arm64-only Mach-O binary written in Rust responsible for credential theft, browser/cookie/wallet database collection, clipboard capture, and exfiltration.
- Regional exclusion logic documented: the dropper aborts on hosts whose locale, timezone, or keyboard layout indicates Russia, Belarus, Kazakhstan, or several neighboring post-Soviet states.
- Stage 1 dropper confirmed as a compiled AppleScript wrapping obfuscated JXA that downloads the second-stage payload via NSURLSession, avoiding shell utilities like curl, and performs host-fingerprint key derivation plus anti-debugging and SIP checks.
- Jamf Threat Labs publishes technical analysis 'PamStealer: a Rust-based macOS infostealer that validates credentials through PAM,' detailing the two-stage AppleScript-to-Rust attack chain.
- Jamf Threat Labs identifies the PamStealer campaign distributing a Rust-based macOS infostealer via the lookalike domain maccyapp[.]com impersonating the legitimate Maccy clipboard manager.
- Threadlinqs threat hunt TL-2026-1100 opened to track active PamStealer distribution, extract IOCs, and produce detection coverage for the campaign.
- The Hacker News and multiple additional outlets (Hackread, CyberPress, Tom's Guide, AppleInsider, Macworld) publish corroborating coverage of Jamf's findings and the PAM-based password validation technique.
Sources cited for PamStealer: macOS Infostealer Distributed via Fake Maccy
- PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords
- PamStealer: a Rust-based macOS infostealer that validates credentials through PAM
- New PamStealer Malware Targets macOS Users via Fake Maccy Clipboard App
- PamStealer macOS Infostealer Uses Rust Payload to Validate and Steal Passwords
- New PamStealer Mac malware poses as a clipboard manager to steal your login info -- how to stay safe
- New Mac infostealer confirms stolen passwords before stealing data
- New malicious clipboard clone raises serious security concerns for Mac users
- PamStealer Malware (Mac) -- Removal steps, and macOS cleanup
- PamStealer Targets macOS Users via Fake Clipboard App -- Credential Theft Through PAM Abuse
- New 'PamStealer' Mac Malware Double-Checks Your Password Before Stealing Your Data
- Newly discovered PamStealer isn't your typical macOS malware
- PamStealer is a Rust-based macOS infostealer that validates credentials through PAM
- PamStealer Skips the Process Chains Defenders Watch. Not All of Them.
- Unmasking PamStealer: The Stealthy macOS Malware That's After Your Digital Keys
Detection coverage for TL-2026-1100
As of 2026-07-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1100 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1100
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.