PamStealer is a two-stage macOS information stealer that masquerades as the Maccy clipboard manager. A JavaScript for Automation (JXA) dropper stages a Rust-based payload that validates the victim's macOS login password through the Pluggable Authentication Modules (PAM) application programming interface (API) before exfiltrating credentials, browser data, and clipboard contents.

Symptoms

You might observe the following artifacts associated with this threat:

• Unexpected prompts for system permissions or passwords, including a delayed Full Disk Access request attributed to Finder.
• Unfamiliar application bundles in Application Support masquerading as system applications.
• Unexpected login items registered under Apple system bundle identifiers.
• Unusual network activity or data usage.

Technical Breakdown

PamStealer is distributed via a fake website impersonating the legitimate Maccy clipboard manager project. Victims are delivered a disk image containing a compiled AppleScript file and are instructed to open it in Script Editor and press Cmd+R. This executes a JXA dropper that fingerprints the device — checking CPU architecture, locale, and timezone — before fetching a second-stage payload. Devices running on Intel processors or with Russian, Belarusian, or Kazakh locales or keyboard layouts are silently excluded.

The second stage is a stripped Rust binary, which makes it harder to analyze than typical Objective-C or Swift payloads. Its most distinguishing behavior is password validation: rather than capturing whatever the victim types, PamStealer validates the entered password against the macOS PAM API before harvesting it, re-prompting until a correct password is confirmed. This occurs without spawning a visible Terminal window or authentication process.

The payload masquerades as Finder, establishing persistence as a login item using both a modern and a legacy registration mechanism. A counterfeit "damaged application" Gatekeeper prompt is displayed immediately, followed by a delayed fake Finder alert — appearing 40 or more minutes after launch — prompting the victim to grant Full Disk Access. Clipboard contents are harvested by polling pbpaste at irregular intervals. Exfiltrated data is sent to attacker-controlled infrastructure encrypted with ChaCha20-Poly1305.

Some of PamStealer's capabilities include:

• macOS Keychain theft
• Browser credential and cookie theft
• Cryptocurrency wallet database collection
• Clipboard monitoring
• Full Disk Access coercion via a delayed fake system prompt
• Encrypted exfiltration

Next Steps

Iru Endpoint Detection & Response (EDR) automatically removes detected threats when file monitoring is set to Protect. While the malicious file is removed, it can leave behind artifacts that need to be cleaned manually.

In the future, avoid downloading applications from sites other than the Mac App Store or the developer's official domain. No legitimate macOS application requires the user to manually run a script in Script Editor to complete installation.