Security researchers have uncovered a previously undocumented macOS infostealer, PamStealer, that uses the operating system's Pluggable Authentication Modules (PAM) to verify stolen user passwords before exfiltrating sensitive data. The malware was discovered by Jamf Threat Labs, which analyzed a sophisticated two-stage attack chain combining AppleScript, JavaScript for Automation (JXA), and a Rust-based payload.

Fake Maccy App Delivers the Malware

Attackers distribute PamStealer through a fake website impersonating the popular Maccy clipboard manager. Victims download a malicious disk image containing a compiled AppleScript that displays fake installation instructions while hiding its malicious code using Greek and Cyrillic homoglyphs to evade text-based detection.

Figure 1. MacOS Security Breach.

Instead of relying on command-line tools such as curl or zsh, the dropper leverages native macOS APIs through JXA and NSURLSession to download the second-stage payload, minimizing suspicious process activity. Figure 1 shows MacOS Security Breach.

Before execution, the malware fingerprints the system by checking the CPU architecture, locale, keyboard layout, and time zone. The analyzed samples target only Apple Silicon Macs and avoid execution on Intel-based systems and devices configured for several former Soviet countries. Researchers also observed anti-debugging techniques and awareness of System Integrity Protection (SIP).

Password Validation Through PAM

The second-stage payload is a stripped ARM64 Mach-O binary written in Rust that steals browser credentials, cookies, cryptocurrency wallet data, clipboard contents, and Keychain information.

A standout feature of PamStealer is its ability to validate user passwords locally using the PAM authentication framework. It presents a convincing macOS password prompt and repeatedly requests credentials until the correct password is entered. Unlike many macOS stealers, it performs password verification without launching utilities such as dscl, security, or osascript, making detection more difficult.

Persistence and Data Theft

To maintain persistence, the malware installs itself as a fake Finder.app within the user's Application Support directory and registers itself as a login item using both modern and legacy macOS persistence mechanisms. It then displays a fake Gatekeeper warning, encouraging users to discard the original installer while the malware continues running unnoticed.

PamStealer also attempts to trick victims into granting Full Disk Access, enabling it to collect data from protected applications such as Mail, Messages, and Time Machine backups.

During execution, the malware continuously monitors clipboard contents using pbpaste and exfiltrates stolen information to its command-and-control server using ChaCha20-Poly1305 encryption [1]. Despite encrypted communications, researchers identified cached command-and-control data stored under the user's cache directory, providing investigators with a valuable forensic artifact.

The researchers also recovered a decrypted configuration containing public Ethereum JSON-RPC endpoints, confirming that the malware communicated with at least one blockchain endpoint during testing.

Detection Recommendations

Jamf recommends monitoring for unusual outbound connections initiated by Script Editor, application bundles created under the Application Support directory, unexpected login item registrations, and processes masquerading as Finder while repeatedly launching pbpaste. Security teams should also investigate unsolicited requests for Full Disk Access, which may indicate an active PamStealer infection.

Reference:

1. https://cyberinsider.com/new-macos-malware-pamstealer-uses-pam-to-validate-stolen-data/

Cite this article:

Keerthana S (2026), New macOS Malware PamStealer Uses PAM to Validate Stolen Data, AnaTechMaz, pp.198