There’s a new Mac infostealer in town, and it’s not like the usual ones.
Researchers at Jamf found PamStealer — a two-stage malware that combines AppleScript with a Rust-based payload. The delivery is clever. It masquerades as Maccy, a clipboard manager, inside a disk image. When the user double-clicks the AppleScript file, it opens in Script Editor with the malicious code buried deep inside.
The script prompts users to press Command-R after opening it. That single key combo triggers the malicious code and bypasses Apple’s quarantine flag. No warning. No restriction.
Stage two is written in Rust — unusual for macOS stealers, which typically use Swift or Go. The Rust binary reads SQLite databases directly and uses macOS’s own PAM (Pluggable Authentication Modules) to validate the victim’s password locally. That means no spawned processes for defenders to detect.
PamStealer shows a fake system prompt asking for the admin password. “Maccy wants to make changes. Enter your password to allow this.” If the password fails, it tries again. Once it gets the right one, it shows an error saying the file is damaged — so the user doesn’t suspect anything. Then it goes after credentials, full disk access, and even Ethereum accounts.
It also delays the full disk access prompt by up to 40 minutes. That way, the request doesn’t line up with the initial infection, making it harder to connect the dots.
Jamf says this is a sign that commodity macOS malware is evolving — quieter, more native, harder to spot.
