# PamStealer: macOS Infostealer Distributed via Fake Maccy Sites Using PAM Password Validation

> Jamf Threat Labs identified PamStealer, a two-stage macOS infostealer distributed via the lookalike domain maccyapp[.]com impersonating the legitimate Maccy clipboard manager. A compiled AppleScript dropper stages a Rust-based Mach-O second stage that validates stolen login passwords through macOS PAM before harvesting browser credentials, cookies, cryptocurrency wallet data, and clipboard contents, then exfiltrates over an encrypted C2 channel.

- **Published:** 2026-07-03T00:00:00Z
- **Last reviewed:** 2026-07-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1100
- **ID:** TL-2026-1100
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PamStealer is a two-stage macOS credential- and cryptocurrency-theft campaign discovered by Jamf Threat Labs and corroborated by The Hacker News and multiple security outlets on 2026-07-02/03. Victims are lured to the typosquat domain maccyapp[.]com, a lookalike of the legitimate open-source clipboard manager maccy.app, and served a disk image containing a compiled AppleScript file (Maccy.scpt). Homoglyph (Greek/Cyrillic lookalike) characters are used within the on-disk 'Maccy' branding text to evade simple string-matching detection, and the victim is socially engineered to open the file in Script Editor and press Command+R to execute it.

Stage 1 is a compiled AppleScript wrapper around obfuscated JavaScript for Automation (JXA). Rather than shelling out to curl or other command-line utilities, it uses NSURLSession to download the second-stage payload, reducing the process-based telemetry defenders typically monitor. Before staging the payload it performs host-fingerprint-based encryption key derivation from CPU architecture, locale, keyboard layout, and timezone, runs anti-debugging checks and SIP status inspection, and aborts entirely on hosts whose locale, timezone, or keyboard layout indicates Russia, Belarus, Kazakhstan, Armenia, Azerbaijan, Kyrgyzstan, Moldova, Tajikistan, Uzbekistan, Turkmenistan, or Georgia. The staged payload is placed inside a masqueraded system app bundle at ~/Library/Application Support/com.apple.finder.core/Finder.app and given ad-hoc code signing (codesign -fs - --deep) rather than a Developer ID signature, satisfying Gatekeeper without needing a legitimate certificate.

Stage 2 is a stripped arm64-only Mach-O binary written in Rust -- an unusual implementation language for macOS stealers, which more commonly use Swift, Go, or Objective-C. Configuration keys fail to decrypt on Intel (x86_64) hardware, causing silent termination and effectively restricting the payload to Apple Silicon. Most strings are decrypted only at runtime to blunt static analysis. The binary bundles SQLite for direct database access to browser credential, cookie, and wallet-extension stores, and loads Security.framework dynamically at runtime (rather than linking it statically) to query the macOS Keychain -- keeping that capability off the binary's static import table. Clipboard contents are harvested by spawning the pbpaste utility from the masqueraded Finder process at irregular 10-90 second intervals.

The defining behavior that gives the malware its name is its password-validation routine: before treasuring a captured login password, PamStealer displays a native NSAlert with a secure text field styled to resemble a system authorization prompt ('Maccy wants to make changes. Enter your password to allow this', with the account name pre-filled), and validates whatever the victim types entirely through the local PAM API (pam_start, pam_authenticate, pam_end) -- with no external process spawned (no dscl, security, or osascript) and no network callout. If validation fails it re-prompts until the correct password is entered, guaranteeing that only a verified, working credential is exfiltrated.

Persistence uses the modern SMAppService API for login-item registration, with a legacy fallback: a 34 KB arm64 helper binary written to /private/tmp/System Settings that uses LSSharedFileListInsertItemURL against kLSSharedFileListSessionLoginItems to add the malicious bundle to login items directly. Separately, to gain the Full Disk Access needed for broader data collection, the malware displays a counterfeit system alert styled with the Finder icon claiming 'Finder' has lost access to protected data -- deliberately delayed 10 to 40 minutes after initial launch to break the temporal link to execution. Clicking 'Open Settings' takes the user directly to the Full Disk Access pane in System Settings, where the malicious bundle appears under the legitimate-looking name 'Finder.' This is purely a social-engineering TCC-permission grab; Jamf observed no exploit-based privilege escalation.

Stolen data is encrypted with ChaCha20-Poly1305 using runtime-generated keys that are never written to disk, wrapped in a '{"data":"..."}' JSON envelope preceded by the build marker string 'MacOSapp1', and POSTed as application/json to the C2 endpoint https://avenger-sync[.]live/api/sync, which is fronted by Cloudflare to obscure the true backend infrastructure. An internally-named configuration object, 'avenger-config-v2', embeds this C2 URL alongside two Ethereum JSON-RPC endpoints (eth.drpc.org and ethereum-rpc.publicnode[.]com), most likely used to query on-chain wallet balances and prioritize which crypto assets to steal. Forensic artifacts include the C2 URL stored in cleartext in a dropped .config file, a .lock file and a .Maccy marker file alongside the staged bundle, a network cache at ~/Library/Caches/com.apple.finder.core/Cache.db holding encrypted C2 exchanges and cleartext connection metadata, and Script Editor cache entries under ~/Library/Caches/com.apple.ScriptEditor2/.

No CVE applies -- this is a malware distribution and social-engineering campaign, not a software vulnerability. No attribution to a named threat actor or nation-state has been published by Jamf or any secondary source as of this writing; the regional exclusion list targeting post-Soviet/CIS territories and the financially-motivated theft of credentials and cryptocurrency are consistent with a financially-motivated cybercriminal operation rather than state-sponsored espionage, but this remains an assessment rather than a confirmed attribution.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1140 Deobfuscate/Decode Files or Information
- T1622 Debugger Evasion
- T1497 Virtualization/Sandbox Evasion
- T1553 Subvert Trust Controls
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1548 Abuse Elevation Control Mechanism
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1056 Input Capture
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1115 Clipboard Data
- T1005 Data from Local System
- T1539 Steal Web Session Cookie
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel

## Sources

- [PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords](https://thehackernews.com/2026/07/pamstealer-uses-fake-maccy-sites-and.html)
- [PamStealer: a Rust-based macOS infostealer that validates credentials through PAM](https://www.jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/)
- [New PamStealer Malware Targets macOS Users via Fake Maccy Clipboard App](https://hackread.com/pamstealer-malware-macos-fake-maccy-clipboard-app/)
- [PamStealer macOS Infostealer Uses Rust Payload to Validate and Steal Passwords](https://cyberpress.org/pamstealer-macos-infostealer/)
- [New PamStealer Mac malware poses as a clipboard manager to steal your login info -- how to stay safe](https://www.tomsguide.com/computing/malware-adware/new-pamstealer-mac-malware-poses-as-a-clipboard-manager-to-steal-your-login-info-how-to-stay-safe)
- [New Mac infostealer confirms stolen passwords before stealing data](https://appleinsider.com/articles/26/07/02/new-mac-infostealer-confirms-stolen-passwords-before-stealing-data)
- [New malicious clipboard clone raises serious security concerns for Mac users](https://www.macworld.com/article/3183300/new-malicious-clipboard-clone-raises-serious-security-concerns-for-mac-users.html)
- [PamStealer Malware (Mac) -- Removal steps, and macOS cleanup](https://www.pcrisk.com/removal-guides/35543-pamstealer-malware-mac)
- [PamStealer Targets macOS Users via Fake Clipboard App -- Credential Theft Through PAM Abuse](https://news.shield53.com/pamstealer-targets-macos-users-via-fake-clipboard-app-credential-theft-through-pam-abuse/)
- [New 'PamStealer' Mac Malware Double-Checks Your Password Before Stealing Your Data](https://www.idropnews.com/news/pamstealer-macos-malware-password-verification/265878)
- [Newly discovered PamStealer isn't your typical macOS malware](https://www.businessstory.org/2026/07/02/newly-discovered-pamstealer-isnt-your-typical-macos-malware/)
- [PamStealer is a Rust-based macOS infostealer that validates credentials through PAM](https://appleworld.today/2026/07/pamstealer-is-a-rust-based-macos-infostealer-that-validates-credentials-through-pam/)
- [PamStealer Skips the Process Chains Defenders Watch. Not All of Them.](https://hashnode.com/posts/pamstealer-macos/6a46df9d083dd30dfb01080d)
- [Unmasking PamStealer: The Stealthy macOS Malware That's After Your Digital Keys](https://hideme.in/overview/unmasking-pamstealer-the-stealthy-macos-malware-thats-after-your-digital-keys/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1100