{"id":739701,"date":"2026-07-02T21:40:08","date_gmt":"2026-07-02T21:40:08","guid":{"rendered":"https:\/\/www.newsbeep.com\/us\/739701\/"},"modified":"2026-07-02T21:40:08","modified_gmt":"2026-07-02T21:40:08","slug":"newly-discovered-pamstealer-isnt-your-typical-macos-malware","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us\/739701\/","title":{"rendered":"Newly discovered PamStealer isn’t your typical macOS malware"},"content":{"rendered":"

Researchers have found a never-before-seen piece of macOS malware that combines a series of clever tradecraft to infect Macs with stealthy, custom-developed credential-stealing code.<\/p>\n

The malware is delivered in two stages. The first is distributed in a disk image that masquerades as Maccy<\/a>, a clipboard manager for Macs. It\u2019s compiled as AppleScript that is notable for the way it delivers the second stage. The malware is named PamStealer because the Rust-written infostealer uses the Pluggable Authentication Modules interface built into macOS to validate the target\u2019s login password before sending it to an attacker-controlled server.<\/p>\n

A quieter execution chain<\/p>\n

The use of both disk image and AppleScript is common in malware for Macs. More unusual is the way PamStealer combines them to gain stealth. When the AppleScript is double-clicked, it\u2019s opened in the macOS Script Editor, where the malicious functionality is buried deep within the file.<\/p>\n

\u201cRather than relying on shell commands such as curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader that retrieves and stages the payload using native Objective-C APIs,\u201d researchers from Jamf, a security firm for macOS users, wrote<\/a>. \u201cCombined with a Rust-based second stage and a password capture workflow that validates credentials locally through PAM, the result is a quieter execution chain than we typically observe in commodity macOS stealers.\u201d<\/p>\n

When a user, expecting to install a trustworthy clipboard manager, encounters the disk image, they\u2019re prompted to press Command-R immediately after double-clicking it. This command executes malicious code inside the AppleScript directly. It also allows the execution to bypass com.apple.quarantine, a macOS attribute that provides warnings and restrictions when executable files have been downloaded from the Internet.<\/p>\n

As Jamf explained:<\/p>\n

PamStealer combines a recently emerging delivery surface with a less familiar payload. While the clickable .scpt and Script Editor lure build on tradecraft that is already gaining adoption across the macOS threat landscape, the malware distinguishes itself through a self-contained JXA dropper, a Rust-based second stage, and a password capture workflow that validates credentials locally through PAM before harvesting them. That second stage puts considerable effort into staying hidden, masquerading as Finder, encrypting its command-and-control traffic, and holding back prompts like the Full Disk Access request for as long as forty minutes so its activity does not line up with launch. Together, these behaviors illustrate how commodity macOS stealers continue to evolve, adopting quieter execution chains and native implementations that reduce traditional detection opportunities while remaining compatible with standard macOS features.<\/p>\n

The first stage puts its payload inside an app bundle that impersonates real components built into macOS. The component changes from sample to sample of the malware. Finder.app under com.apple.finder.core or com.apple.finder.monitor, and a Software Update.app under com.apple.security.daemon, are two examples. In either case, they run hidden. They also display macOS\u2019s genuine Finder.icns as its icon.<\/p>\n","protected":false},"excerpt":{"rendered":"Researchers have found a never-before-seen piece of macOS malware that combines a series of clever tradecraft to infect…\n","protected":false},"author":2,"featured_media":739702,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[74],"class_list":["post-739701","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/739701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=739701"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/739701\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/739702"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=739701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=739701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=739701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}