Security
PamStealer uses sophisticated tradecraft to steal macOS passwords undetected
Security researchers uncovered a stealthy new credential-stealing malware that leverages native macOS features and multi-stage deployment to evade traditional detection.
Ars Technica
Jamf security researchers have identified a previously unknown macOS malware called PamStealer that employs an unusually sophisticated approach to infect machines and extract user credentials while remaining under the radar of standard security measures.
Two-stage deployment disguised as legitimate software#
The attack begins with a disk image masquerading as Maccy, a popular clipboard management application. When users attempt to install what they believe is trustworthy software, they receive a prompt to press Command-R immediately after double-clicking the image. This keystroke combination triggers malicious code hidden within an AppleScript file and simultaneously bypasses com.apple.quarantine, the macOS security attribute that typically warns users about downloaded executables.
A quieter execution chain#
What distinguishes PamStealer from typical commodity malware is its reliance on native macOS technologies rather than conventional system commands. Instead of using tools like curl or shell scripts, the first-stage AppleScript deploys a JavaScript for Automation (JXA) downloader that retrieves the second-stage payload using native Objective-C APIs.
The second stage, written in Rust, then masquerades as legitimate system components—such as Finder.app or Software Update.app—using their genuine icons and bundle identifiers. This payload deliberately delays intrusive requests like Full Disk Access prompts by up to forty minutes, desynchronizing its activity from the initial launch window and reducing the likelihood of detection.
The malware's name derives from its use of the Pluggable Authentication Modules (PAM) interface built into macOS. Rather than transmitting passwords immediately upon capture, PamStealer validates credentials locally through PAM before harvesting and forwarding them to attacker-controlled servers. This validation step adds another layer of operational stealth.
Why it matters#
As Jamf noted, PamStealer demonstrates how macOS threats continue to evolve by adopting quieter execution chains and native implementations that sidestep traditional detection opportunities while remaining fully compatible with legitimate macOS features. The combination of AppleScript distribution, JXA automation, Rust payloads, and PAM-based credential handling represents a maturation of the macOS threat landscape.
