Mac users looking for a clipboard manager are getting more than they bargained for. A fake version of the open-source app Maccy is installing a Rust-based infostealer codenamed PamStealer.
Jamf Threat Labs caught it. Here’s how it works: a lookalike website serves a disk image with a malicious AppleScript file. Open it, and you’re told to run it in Script Editor. The bad code’s hidden further down the document — out of sight, out of mind.
The malware validates your login password through macOS PAM before stealing it. That’s where the name comes from. Then it uses JavaScript for Automation and native macOS APIs to pull down a second-stage payload. No curl, no zsh — fewer traces for security tools to spot.
That second stage is a Rust binary built for Apple Silicon. It disguises itself as Finder or Software Update. It derives a decryption key from your machine’s fingerprint — CPU architecture, locale, keyboard layout, time zone — and unlocks an encrypted config containing the real payload URL and install path.
Once inside, PamStealer steals browser credentials, Keychain data, monitors your clipboard, and phones home to a C2 server. It even shows a fake Finder alert asking for Full Disk Access, up to 40 minutes after infection. Approve that, and it gets into Mail, Messages, Time Machine backups.
There’s a twist: if it can’t verify it’s on the right target, it quietly shuts itself down.
Jamf hasn’t seen PamStealer in the wild yet. They’ve notified Apple. But the social engineering technique is spreading — they also spotted a sponsored X ad redirecting users to a fake DynamicLake download site that delivered Atomic Stealer instead.
