# PamStealer: Rust-Based macOS Infostealer Masquerades as Maccy Clipboard Manager, Validates Stolen Passwords via PAM

> PamStealer is a two-stage Rust-based macOS infostealer distributed via a malicious 'Maccy.dmg' disk image and lookalike domains (maccyapp[.]com, maccyapp[.]net) impersonating the legitimate open-source Maccy clipboard manager. A compiled AppleScript/JXA first-stage dropper performs environment fingerprinting and region-avoidance checks before staging a Rust Mach-O second stage that displays a fake system password prompt, locally validates the captured password via macOS PAM APIs, and exfiltrates browser credentials, cookies, cryptocurrency wallet data, iCloud Keychain items, and clipboard contents over a ChaCha20-Poly1305 encrypted C2 channel at avenger-sync[.]live.

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-08-17T17:54:10.951Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1104
- **ID:** TL-2026-1104
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Jamf Threat Labs identified and disclosed PamStealer, a novel macOS credential- and data-theft campaign distributed through a fake disk image, 'Maccy.dmg', and typosquat domains (maccyapp[.]com and maccyapp[.]net) impersonating the legitimate open-source clipboard manager Maccy (official site: maccy[.]app). Victims are social-engineered into opening a compiled AppleScript (.scpt) file bundled in the disk image; the script's on-screen instructions (which employ Greek/Cyrillic homoglyph characters in the rendered 'Maccy' branding to evade simple string-matching detections) tell the user to press Cmd+R in Script Editor to 'Run' the file, triggering the embedded malicious payload.

The first stage is a compiled AppleScript that executes a JavaScript for Automation (JXA) payload using native macOS APIs such as NSURLSession rather than shell utilities like curl or zsh, reducing telemetry and detection surface. Before staging the second-stage payload, the dropper performs environment fingerprinting: it derives an encryption/config key from CPU architecture, system locale, keyboard layout, and timezone, and checks System Integrity Protection (SIP) status to avoid sandboxed or analysis environments. It also implements explicit regional exclusion logic, refusing to proceed on systems whose timezone or locale indicates Russia, Belarus, Kazakhstan, Armenia, Azerbaijan, Kyrgyzstan, Moldova, Tajikistan, Uzbekistan, Georgia, or Turkmenistan (timezones observed: Europe/Moscow, Europe/Minsk, Asia/Almaty; locale codes: RU, BY, KZ, AM, AZ, KG, MD, TJ, UZ, TM, GE) — a pattern consistent with Russian/CIS-region threat-actor operational security norms, though Jamf did not issue a formal attribution.

On qualifying hosts, the dropper downloads a Rust-compiled Mach-O binary (arm64/Apple Silicon only — no x86_64 variant observed), writes it to disk as executable, and ad-hoc signs it via 'codesign -fs - --deep' to satisfy Gatekeeper on unnotarized binaries. The payload and its supporting artifacts are staged inside a fake application bundle masquerading as Finder, installed at ~/Library/Application Support/com.apple.finder.core/Finder.app (binary at Contents/MacOS/77617EA0), using bundle identifiers such as com.apple.finder.core, com.apple.finder.monitor, and com.apple.security.daemon to blend in with legitimate Apple system processes. A hidden marker file, '.Maccy', is dropped to track infection state, and a plaintext '.config' file stores the C2 URL.

The Rust second stage is the credential-validation component that gives the malware its name: it displays a native macOS NSAlert with a secure text field, styled to look like a system authorization dialog and titled after the lure — 'Maccy wants to make changes. Enter your password to allow this' — with the victim's account name pre-filled to increase legitimacy. Whatever the victim types is validated locally and immediately via the macOS Pluggable Authentication Module (PAM) API (pam_start, pam_authenticate, pam_end); if validation fails, the dialog re-focuses and re-prompts, looping until the correct system password is captured, ensuring the operators only exfiltrate confirmed-valid credentials. After a valid password is obtained, the malware displays a decoy error — '"Maccy" is damaged and can't be opened. You should move it to the Trash' — to discourage the victim from further investigating the (deleted) disk image.

With the verified password and elevated local trust established, the Rust stealer collects: browser-stored passwords, cookies, and cryptocurrency wallet extension data by directly querying browser SQLite databases; iCloud Keychain items via runtime/dynamically loaded macOS Security.framework calls (avoiding static-analysis detection of Keychain API usage); and clipboard contents by repeatedly invoking the 'pbpaste' utility at irregular 10-30 second intervals to catch copy-pasted secrets, seed phrases, and one-time codes.

For persistence, PamStealer registers itself as a login item through two parallel mechanisms: the modern ServiceManagement framework API (SMAppService), and a legacy method using a small (~34KB) helper binary dropped at /private/tmp/System Settings (also referred to as /tmp/System Settings), which calls LSSharedFileListInsertItemURL against kLSSharedFileListSessionLoginItems to register the same fake Finder bundle through the deprecated login-items interface — providing redundant persistence if either mechanism is remediated independently. Separately, after a variable delay of up to 40 minutes (likely to reduce correlation with the initial install), the malware displays a counterfeit system alert styled with the Finder icon, claiming Finder has lost file access and prompting the user to click a Settings button; if the victim complies, the malware is granted Full Disk Access without any further prompts, giving it unrestricted read access to the user's files, Mail data, Messages, and Time Machine backups.

Exfiltrated data is packaged into a JSON envelope with a distinctive marker string 'MacOSapp1{"data":""}' and encrypted with ChaCha20-Poly1305 before being POSTed to the C2 endpoint https://avenger-sync[.]live/api/sync, which is fronted by Cloudflare to obscure the true origin server and complicate takedown/attribution. Locally, network activity leaves forensic traces in ~/Library/Caches/com.apple.finder.core/Cache.db (an NSURLCache database that retains plaintext metadata of the encrypted C2 exchanges even though the payload itself is encrypted) and in ~/Library/HTTPStorages/com.apple.finder.core/. Decrypted configuration data recovered from the sample also referenced public Ethereum JSON-RPC endpoints (eth.drpc.org and ethereum-rpc.publicnode[.]com), suggesting the operators may use blockchain-based infrastructure (e.g., on-chain data storage or dead-drop resolvers) for resilient, takedown-resistant C2 backup/failover — a technique increasingly seen in cybercriminal loader and stealer families.

The legitimate Maccy developer, Alex Rodionov, has posted a public warning on the project's website and GitHub repository after the campaign was disclosed, explicitly naming the fake domains: 'Beware of fake websites impersonating Maccy. Malicious sites (such as maccyapp[.]net and maccyapp[.]com) distribute malware disguised as Maccy. Maccy[.]app is the only official website.' No CVE applies, as this is a malware distribution/social-engineering campaign rather than a software vulnerability. No formal threat-actor attribution or named APT/crimeware group has been published by Jamf Threat Labs as of this writing; the campaign is tracked purely under the malware family name PamStealer.

## MITRE ATT&CK

- T1566 Phishing
- T1566.003 Spearphishing via Service
- T1195 Supply Chain Compromise
- T1059.002 AppleScript
- T1204.002 Malicious File
- T1106 Native API
- T1547.015 Login Items
- T1543 Create or Modify System Process
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1553.001 Gatekeeper Bypass
- T1497.001 System Checks
- T1685 Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1056.002 GUI Input Capture
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1187 Forced Authentication
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1614.001 System Language Discovery
- T1518.001 Security Software Discovery
- T1115 Clipboard Data
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1102 Web Service
- T1008 Fallback Channels
- T1090.004 Domain Fronting
- T1041 Exfiltration Over C2 Channel
- T1583.001 Domains
- T1587.001 Malware
- T1585.001 Social Media Accounts
- T1531 Account Access Removal
- T1189 Drive-by Compromise
- T1059.007 Command and Scripting Interpreter

## Sources

- [PamStealer Mimics Maccy Clipboard Manager Silently Harvests Data and Clipboard Contents](https://cybersecuritynews.com/pamstealer-mimic-as-maccy-harvest/)
- [PamStealer: macOS Malware Posing as Clipboard Manager App](https://www.jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/)
- [PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords](https://thehackernews.com/2026/07/pamstealer-uses-fake-maccy-sites-and.html)
- [New PamStealer Malware Targets macOS Users via Fake Maccy Clipboard App](https://hackread.com/pamstealer-malware-macos-fake-maccy-clipboard-app/)
- [Newly discovered PamStealer isn't your typical macOS malware](https://www.businessstory.org/2026/07/02/newly-discovered-pamstealer-isnt-your-typical-macos-malware/)
- [New macOS malware PamStealer uses PAM to validate stolen data](https://cyberinsider.com/new-macos-malware-pamstealer-uses-pam-to-validate-stolen-data/)
- [PamStealer Malware (Mac) - Removal steps, and macOS cleanup](https://www.pcrisk.com/removal-guides/35543-pamstealer-malware-mac)
- [PamStealer macOS Infostealer Uses Rust Payload to Validate and Steal Passwords](https://cyberpress.org/pamstealer-macos-infostealer/)
- [Mac Infostealer Weaponizes Apple's Own PAM API to Verify Stolen Passwords First](https://www.techtimes.com/articles/319689/20260704/mac-infostealer-weaponizes-apples-own-pam-api-verify-stolen-passwords-first.htm)
- [Maccy: PamStealer macOS Infostealer Uses Rust Payload to Validate and Steal Passwords](https://blog.rankiteo.com/the1783081538-maccy-cyber-attack-july-2026/)
- [New PamStealer Mac malware poses as a clipboard manager to steal your login info — how to stay safe](https://www.tomsguide.com/computing/malware-adware/new-pamstealer-mac-malware-poses-as-a-clipboard-manager-to-steal-your-login-info-how-to-stay-safe)
- [New malicious clipboard clone raises serious security concerns for Mac users](https://www.macworld.com/article/3183300/new-malicious-clipboard-clone-raises-serious-security-concerns-for-mac-users.html)
- [PamStealer macOS Malware Validates Passwords via PAM](https://www.it-connect.tech/pamstealer-macos-malware-verifies-your-password-before-stealing-it/)
- [Malware News - PamStealer, a Rust-based macOS infostealer masquerading as Maccy, uses a two-stage attack to silently harvest data and clipboard contents](https://malwaretips.com/threads/pamstealer-a-rust-based-macos-infostealer-masquerading-as-maccy-uses-a-two-stage-attack-to-silently-harvest-data-and-clipboard-contents.142077/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1104