PamStealer: Rust-Based macOS Infostealer Masquerades as Maccy Clipboard Manager, Validates Stolen Passwords via PAM — Threadlinqs Intelligence
As of 2026-07-05, PamStealer: Rust-Based macOS Infostealer Masquerades as Maccy Clipboard Manager, Validates Stolen Passwords via PAM is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-1104 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
PamStealer is a two-stage Rust-based macOS infostealer distributed via a malicious 'Maccy.dmg' disk image and lookalike domains (maccyapp[.]com, maccyapp[.]net) impersonating the legitimate
Jamf Threat Labs identified and disclosed PamStealer, a novel macOS credential- and data-theft campaign distributed through a fake disk image, 'Maccy.dmg', and typosquat domains (maccyapp[.]com and maccyapp[.]net) impersonating the legitimate open-source clipboard manager Maccy (official site: maccy[.]app). Victims are social-engineered into opening a compiled AppleScript (.scpt) file bundled in the disk image; the script's on-screen instructions (which employ Greek/Cyrillic homoglyph characters in the rendered 'Maccy' branding to evade simple string-matching detections) tell the user to press Cmd+R in Script Editor to 'Run' the file, triggering the embedded malicious payload.
The first stage is a compiled AppleScript that executes a JavaScript for Automation (JXA) payload using native macOS APIs such as NSURLSession rather than shell utilities like curl or zsh, reducing telemetry and detection surface. Before staging the second-stage payload, the dropper performs environment fingerprinting: it derives an encryption/config key from CPU architecture, system locale, keyboard layout, and timezone, and checks System Integrity Protection (SIP) status to avoid sandboxed or analysis environments. It also implements explicit regional exclusion logic, refusing to proceed on systems whose timezone or locale indicates Russia, Belarus, Kazakhstan, Armenia, Azerbaijan, Kyrgyzstan, Moldova, Tajikistan, Uzbekistan, Georgia, or Turkmenistan (timezones observed: Europe/Moscow, Europe/Minsk, Asia/Almaty; locale codes: RU, BY, KZ, AM, AZ, KG, MD, TJ, UZ, TM, GE) — a pattern consistent with Russian/CIS-region threat-actor operational security norms, though Jamf did not issue a formal attribution.
On qualifying hosts, the dropper downloads a Rust-compiled Mach-O binary (arm64/Apple Silicon only — no x86_64 variant observed), writes it to disk as executable, and ad-hoc signs it via 'codesign -fs - --deep' to satisfy Gatekeeper on unnotarized binaries. The payload and its supporting artifacts are staged inside a fake application bundle masquerading as Finder, installed at ~/Library/Application Support/com.apple.finder.core/Finder.app (binary at Contents/MacOS/77617EA0), using bundle identifiers such as com.apple.finder.core, com.apple.finder.monitor, and com.apple.security.daemon to blend in with legitimate Apple system processes. A hidden marker file, '.Maccy', is dropped to track infection state, and a plaintext '.config' file stores the C2 URL.
The Rust second stage is the credential-validation component that gives the malware its name: it displays a native macOS NSAlert with a secure text field, styled to look like a system authorization dialog and titled after the lure — 'Maccy wants to make changes. Enter your password to allow this' — with the victim's account name pre-filled to increase legitimacy. Whatever the victim types is validated locally and immediately via the macOS Pluggable Authentication Module (PAM) API (pam_start, pam_authenticate, pam_end); if validation fails, the dialog re-focuses and re-prompts, looping until the correct system password is captured, ensuring the operators only exfiltrate confirmed-valid credentials. After a valid password is obtained, the malware displays a decoy error — '"Maccy" is damaged and can't be opened. You should move it to the Trash' — to discourage the victim from further investigating the (deleted) disk image.
With the verified password and elevated local trust established, the Rust stealer collects: browser-stored passwords, cookies, and cryptocurrency wallet extension data by directly querying browser SQLite databases; iCloud Keychain items via runtime/dynamically loaded macOS Security.framework calls (avoiding static-analysis detection of Keychain API usage); and clipboard contents by repeatedly invoking the 'pbpaste' utility at irregular 10-30 second intervals to catch copy-pasted secrets, seed phrases, and one-time codes.
For persistence, PamStealer registers itself as a login item thro
Weaknesses (CWE)
CWE-451, CWE-494, CWE-311, CWE-522
Target sectors: individuals, technology, cryptocurrency, finance, software development
Target regions: North America, Europe, Asia-Pacific, Global (excluding Russia and CIS states)
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566.003, T1195, T1059.002, T1204.002, T1106, T1547.015, T1543, T1548, T1036