PamStealer: Rust-Based macOS Infostealer Masquerades as Maccy Clipboard Manager, Validates Stolen Passwords via PAM
PamStealer: Rust-Based macOS Infostealer Masquerades as (TL-2026-1104), also tracked as PamStealer, is a high-severity malware campaign, first published 2026-07-05 and last reviewed 2026-08-17. It has no confirmed attribution, affects Apple macOS, maps to 44 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 39 indicators of compromise.
Key facts for TL-2026-1104
- Threat ID
- TL-2026-1104
- Also known as
- PamStealer, Fake Maccy Stealer
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-05
- Last reviewed
- 2026-08-17
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- individuals, technology, cryptocurrency, finance, software development
- Target regions
- North America, Europe, Asia-Pacific, Global (excluding Russia and CIS states)
- Detection rules
- 9
- Indicators of compromise
- 39
- Updates
- 2026-08-17 · revalidated 1× · latest source
Malware and tooling in PamStealer: Rust-Based macOS Infostealer Masquerades as
Malware and tooling: PamStealer, ChaCha20-Poly1305 encrypted JSON C2 protocol (marker string MacOSapp1{"data":""})
PamStealer is a two-stage Rust-based macOS infostealer distributed via a malicious 'Maccy.dmg' disk image and lookalike domains (maccyapp[.]com, maccyapp[.]net) impersonating the legitimate open-source Maccy clipboard manager. A compiled AppleScript/JXA first-stage dropper performs environment fingerprinting and region-avoidance checks before staging a Rust Mach-O second stage that displays a fake system password prompt, locally validates the captured password via macOS PAM APIs, and exfiltrates browser credentials, cookies, cryptocurrency wallet data, iCloud Keychain items, and clipboard contents over a ChaCha20-Poly1305 encrypted C2 channel at avenger-sync[.]live.
How PamStealer: Rust-Based macOS Infostealer Masquerades as works
Jamf Threat Labs identified and disclosed PamStealer, a novel macOS credential- and data-theft campaign distributed through a fake disk image, 'Maccy.dmg', and typosquat domains (maccyapp[.]com and maccyapp[.]net) impersonating the legitimate open-source clipboard manager Maccy (official site: maccy[.]app). Victims are social-engineered into opening a compiled AppleScript (.scpt) file bundled in the disk image; the script's on-screen instructions (which employ Greek/Cyrillic homoglyph characters in the rendered 'Maccy' branding to evade simple string-matching detections) tell the user to press Cmd+R in Script Editor to 'Run' the file, triggering the embedded malicious payload.
The first stage is a compiled AppleScript that executes a JavaScript for Automation (JXA) payload using native macOS APIs such as NSURLSession rather than shell utilities like curl or zsh, reducing telemetry and detection surface. Before staging the second-stage payload, the dropper performs environment fingerprinting: it derives an encryption/config key from CPU architecture, system locale, keyboard layout, and timezone, and checks System Integrity Protection (SIP) status to avoid sandboxed or analysis environments. It also implements explicit regional exclusion logic, refusing to proceed on systems whose timezone or locale indicates Russia, Belarus, Kazakhstan, Armenia, Azerbaijan, Kyrgyzstan, Moldova, Tajikistan, Uzbekistan, Georgia, or Turkmenistan (timezones observed: Europe/Moscow, Europe/Minsk, Asia/Almaty; locale codes: RU, BY, KZ, AM, AZ, KG, MD, TJ, UZ, TM, GE) — a pattern consistent with Russian/CIS-region threat-actor operational security norms, though Jamf did not issue a formal attribution.
On qualifying hosts, the dropper downloads a Rust-compiled Mach-O binary (arm64/Apple Silicon only — no x86_64 variant observed), writes it to disk as executable, and ad-hoc signs it via 'codesign -fs - --deep' to satisfy Gatekeeper on unnotarized binaries. The payload and its supporting artifacts are staged inside a fake application bundle masquerading as Finder, installed at ~/Library/Application Support/com.apple.finder.core/Finder.app (binary at Contents/MacOS/77617EA0), using bundle identifiers such as com.apple.finder.core, com.apple.finder.monitor, and com.apple.security.daemon to blend in with legitimate Apple system processes. A hidden marker file, '.Maccy', is dropped to track infection state, and a plaintext '.config' file stores the C2 URL.
The Rust second stage is the credential-validation component that gives the malware its name: it displays a native macOS NSAlert with a secure text field, styled to look like a system authorization dialog and titled after the lure — 'Maccy wants to make changes. Enter your password to allow this' — with the victim's account name pre-filled to increase legitimacy. Whatever the victim types is validated locally and immediately via the macOS Pluggable Authentication Module (PAM) API (pam_start, pam_authenticate, pam_end); if validation fails, the dialog re-focuses and re-prompts, looping until the correct system password is captured, ensuring the operators only exfiltrate confirmed-valid credentials. After a valid password is obtained, the malware displays a decoy error — '"Maccy" is damaged and can't be opened. You should move it to the Trash' — to discourage the victim from further investigating the (deleted) disk image.
With the verified password and elevated local trust established, the Rust stealer collects: browser-stored passwords, cookies, and cryptocurrency wallet extension data by directly querying browser SQLite databases; iCloud Keychain items via runtime/dynamically loaded macOS Security.framework calls (avoiding static-analysis detection of Keychain API usage); and clipboard contents by repeatedly invoking the 'pbpaste' utility at irregular 10-30 second intervals to catch copy-pasted secrets, seed phrases, and one-time codes.
For persistence, PamStealer registers itself as a login item through two parallel mechanisms: the modern ServiceManagement framework API (SMAppService), and a legacy method using a small (~34KB) helper binary dropped at /private/tmp/System Settings (also referred to as /tmp/System Settings), which calls LSSharedFileListInsertItemURL against kLSSharedFileListSessionLoginItems to register the same fake Finder bundle through the deprecated login-items interface — providing redundant persistence if either mechanism is remediated independently. Separately, after a variable delay of up to 40 minutes (likely to reduce correlation with the initial install), the malware displays a counterfeit system alert styled with the Finder icon, claiming Finder has lost file access and prompting the user to click a Settings button; if the victim complies, the malware is granted Full Disk Access without any further prompts, giving it unrestricted read access to the user's files, Mail data, Messages, and Time Machine backups.
Exfiltrated data is packaged into a JSON envelope with a distinctive marker string 'MacOSapp1{"data":""}' and encrypted with ChaCha20-Poly1305 before being POSTed to the C2 endpoint https://avenger-sync[.]live/api/sync, which is fronted by Cloudflare to obscure the true origin server and complicate takedown/attribution. Locally, network activity leaves forensic traces in ~/Library/Caches/com.apple.finder.core/Cache.db (an NSURLCache database that retains plaintext metadata of the encrypted C2 exchanges even though the payload itself is encrypted) and in ~/Library/HTTPStorages/com.apple.finder.core/. Decrypted configuration data recovered from the sample also referenced public Ethereum JSON-RPC endpoints (eth.drpc.org and ethereum-rpc.publicnode[.]com), suggesting the operators may use blockchain-based infrastructure (e.g., on-chain data storage or dead-drop resolvers) for resilient, takedown-resistant C2 backup/failover — a technique increasingly seen in cybercriminal loader and stealer families.
The legitimate Maccy developer, Alex Rodionov, has posted a public warning on the project's website and GitHub repository after the campaign was disclosed, explicitly naming the fake domains: 'Beware of fake websites impersonating Maccy. Malicious sites (such as maccyapp[.]net and maccyapp[.]com) distribute malware disguised as Maccy. Maccy[.]app is the only official website.' No CVE applies, as this is a malware distribution/social-engineering campaign rather than a software vulnerability. No formal threat-actor attribution or named APT/crimeware group has been published by Jamf Threat Labs as of this writing; the campaign is tracked purely under the malware family name PamStealer.
MITRE ATT&CK techniques used in TL-2026-1104
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1115 Clipboard Data
Command and Control
T1008 Fallback Channels; T1071.001 Web Protocols; T1090.004 Domain Fronting; T1102 Web Service; T1573.001 Symmetric Cryptography
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1553.002 Subvert Trust Controls; T1564.001 Hidden Files and Directories; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
T1056.002 GUI Input Capture; T1187 Forced Authentication; T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers; T1556 Modify Authentication Process
Execution
T1059.002 AppleScript; T1059.007 Command and Scripting Interpreter; T1106 Native API; T1204.002 Malicious File
Discovery
T1082 System Information Discovery; T1518.001 Security Software Discovery; T1614 System Location Discovery; T1614.001 System Language Discovery
Initial Access
T1189 Drive-by Compromise; T1195 Supply Chain Compromise; T1566 Phishing; T1566.003 Spearphishing via Service
Impact
Persistence
T1543 Create or Modify System Process; T1547.015 Login Items
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
defense-impairment
T1553.001 Gatekeeper Bypass; T1685 Disable or Modify Tools
Resource Development
T1583.001 Domains; T1585.001 Social Media Accounts; T1587.001 Malware
Affected products and versions in PamStealer: Rust-Based macOS Infostealer Masquerades as
- Apple — macOS
Vulnerable versions: macOS running on Apple Silicon (arm64) - Maccy (open-source project, impersonated) — Maccy Clipboard Manager (lookalike/typosquat distribution)
Vulnerable versions: Any version downloaded from maccyapp[.]com or maccyapp[.]net
Fixed in: Official releases from maccy[.]app / official GitHub repository are not affected
Remediation for PamStealer: Rust-Based macOS Infostealer Masquerades as
Immediate actions
- Block network traffic to avenger-sync[.]live and its /api/sync endpoint at perimeter firewalls, DNS resolvers, and web proxies
- Block/sinkhole lookalike domains maccyapp[.]com and maccyapp[.]net
- Search endpoint fleets for the fake Finder bundle at ~/Library/Application Support/com.apple.finder.core/Finder.app and the marker file .Maccy
- Remove the illegitimate login item / persistence helper at /private/tmp/System Settings and de-register it from kLSSharedFileListSessionLoginItems and SMAppService
- Revoke Full Disk Access for any unrecognized 'Finder'-named or com.apple.finder.core/com.apple.finder.monitor/com.apple.security.daemon-labeled process in System Settings > Privacy & Security
- Force a system password reset and rotate all browser-saved passwords, cookies/session tokens, and cryptocurrency wallet credentials on any host suspected of infection
- Quarantine and forensically image any host that ran a downloaded Maccy.dmg or visited maccyapp[.]com / maccyapp[.]net before wiping
Workarounds
- Disable AppleScript/.scpt auto-run prompts and restrict Script Editor execution via MDM configuration profiles
- Restrict Full Disk Access grants to an allowlist of known-good applications via MDM (Privacy Preferences Policy Control payload)
- Only download Maccy from the official maccy[.]app site or its GitHub repository, never from search-ad links or third-party mirrors
Longer-term hardening
- Deploy macOS EDR/XDR with behavioral detection for JXA/AppleScript spawning codesign against user-writable Application Support paths
- Enforce Gatekeeper/notarization policy and alert on ad-hoc signed (codesign -fs -) unnotarized Mach-O binaries executing from ~/Library paths
- Monitor for anomalous, high-frequency pbpaste process execution as a clipboard-scraping indicator
- Deploy DNS-layer filtering / RPZ blocking for newly registered typosquat domains of popular open-source macOS utility projects
- User awareness training on verifying developer download links only from official GitHub/project websites and being suspicious of 'press Run' instructions in Script Editor
- Monitor egress to public blockchain RPC endpoints (e.g., eth.drpc.org, ethereum-rpc.publicnode[.]com) from unexpected processes as a potential C2 fallback indicator
Weaknesses (CWE) in PamStealer: Rust-Based macOS Infostealer Masquerades as
CWE-451, CWE-494, CWE-311, CWE-522
Timeline of PamStealer: Rust-Based macOS Infostealer Masquerades as
- Estimated earliest window of active distribution based on lookalike domain activity and sample collection preceding public disclosure; exact first-seen date not published by Jamf Threat Labs.
- Jamf Threat Labs identifies and begins analyzing the PamStealer campaign, distributed via a fake 'Maccy.dmg' disk image and lookalike domains maccyapp[.]com and maccyapp[.]net impersonating the legitimate Maccy clipboard manager.
- Secondary security outlets (Rankiteo, BusinessStory) republish and summarize the Jamf findings, expanding public awareness of the campaign.
- Jamf publishes its technical blog post 'PamStealer: macOS Malware Posing as Clipboard Manager App', detailing the two-stage AppleScript/JXA-to-Rust-Mach-O attack chain, PAM-based password validation, and C2 infrastructure at avenger-sync[.]live.
- ManageEngine's Malware Protection Plus catalogs the campaign as 'FakeMaccy Stealer,' documenting a build variant with a different Application Support directory name (com.apple.finder.monitor) and a different C2 domain (avengerflow[.]com/api/sync) behind distinct Cloudflare front IPs, consistent with Jamf's automated-builder assessment.
- Additional outlets (HackRead, CyberInsider, CyberPress, IT-Connect) publish independent write-ups covering the malware's persistence and Full Disk Access social-engineering tactics.
- Maccy developer Alex Rodionov posts a public warning on the project website and GitHub repository, naming maccyapp[.]com and maccyapp[.]net as malicious impersonation sites and confirming maccy[.]app as the sole official source.
- Threadlinqs Intelligence Platform opens hunt TL-2026-1104 based on the Cyber Security News report, citing PAM-based local validation, region-avoidance checks, and Maccy impersonation as novel, previously uncatalogued TTPs warranting tracking.
- Mainstream and consumer-security outlets (TechTimes, Tom's Guide, Macworld, PCrisk, Cyber Security News) publish consumer-facing warnings, removal guides, and 'how to stay safe' advisories for PamStealer/Maccy.dmg.
- Threadlinqs Threat Intelligence completes deep-dive research consolidating Jamf's technical disclosure with cross-source reporting into a structured threat record.
- PCRisk publishes a consumer-facing removal guide including a SHA-256 sample hash referenced on VirusTotal and a consolidated IOC list for PamStealer.
Update history for TL-2026-1104
- 2026-08-17 — PamStealer: Rust/AppleScript macOS Infostealer Impersonating Maccy Clipboard Manager: What changed No severity/exploitability/status escalation — still HIGH/ACTIVE/ACTIVE. Newer reporting (through 2026-08-14) confirms a second tracked build variant ('FakeMaccy Stealer', per ManageEngine) and Jamf's assessment that the campai
Sources cited for PamStealer: Rust-Based macOS Infostealer Masquerades as
- PamStealer Mimics Maccy Clipboard Manager Silently Harvests Data and Clipboard Contents
- PamStealer: macOS Malware Posing as Clipboard Manager App
- PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords
- New PamStealer Malware Targets macOS Users via Fake Maccy Clipboard App
- Newly discovered PamStealer isn't your typical macOS malware
- New macOS malware PamStealer uses PAM to validate stolen data
- PamStealer Malware (Mac) - Removal steps, and macOS cleanup
- PamStealer macOS Infostealer Uses Rust Payload to Validate and Steal Passwords
- Mac Infostealer Weaponizes Apple's Own PAM API to Verify Stolen Passwords First
- Maccy: PamStealer macOS Infostealer Uses Rust Payload to Validate and Steal Passwords
- New PamStealer Mac malware poses as a clipboard manager to steal your login info — how to stay safe
- New malicious clipboard clone raises serious security concerns for Mac users
- PamStealer macOS Malware Validates Passwords via PAM
- Malware News - PamStealer, a Rust-based macOS infostealer masquerading as Maccy, uses a two-stage attack to silently harvest data and clipboard contents
Threats related to PamStealer: Rust-Based macOS Infostealer Masquerades as
- PamStealer: macOS Infostealer Distributed via Fake Maccy Sites Using PAM Password Validation
- CrashStealer: Novel macOS Information Stealer Disguised as Apple Crash Reporter (Jamf Threat Labs)
- Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and MacSync Campaign
- EtherRAT: Node.js Remote Access Trojan with Ethereum Blockchain C2 Resolution and Per-Execution Self-Reobfuscation
- CrashStealer: Notarized Fake Apple CrashReporter App Steals macOS Keychain, Browser, and Crypto Wallet Credentials
- macOS ClickFix Campaign Using Browser Fingerprinting Gate to Distribute Atomic Stealer (AMOS) and MacSync Infostealers
Detection coverage for TL-2026-1104
As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1104 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1104
5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.