PamStealer the macOS threat that disguises Finder and steals passwords and keys

A new threat to macOS, nicknamed PamStealer It shows how sophisticated and silent campaigns that seek to steal credentials and sensitive data can now be. It is not a simple attachment or an executable packaging: the authors have combined a dropper in AppleScript with a JavaScript for Automation (JXA) charger and a second native stadium written in Rust to reduce detection signals and exploit legitimate system behaviors.

The vector of deception begins on the web. The attackers have created sites that mimic the Maccy project page, the open source clipboard manager, and distribute a disk image (.dmg) containing a .scpt file compiled with instructions to download and deploy the malicious binary. The Social Engineering Trick includes forcing the user to run the script from the Editor Script (-) or by pressing Run) because the malicious code is hidden behind a large block of blank lines; that technique prevents the content from being obvious to the naked eye and can evade automatic controls that look at only the first lines.

More worrying is the way PamStealer checks that it is on the desired target before acting. The dropper makes a computer footprint and derives a decipher key based on architecture (Apple Silicon vs Intel), regional configuration, keyboard and time zone. If the equipment does not meet the conditions (for example, if it is Intel or if the system appears to be located in Eastern European countries), the installer stops. This targeted profiling it makes it difficult to analyse in laboratory environments and helps to avoid detection in regions of origin of operators.

When you get over those barriers, the second stage - a Macho-O binary in Rust that passes through Finder - starts collecting data: histories and browser credentials, cryptographic wallet extensions, clipboard content and even iCloud Keychain items. In addition, in order to remove the permit friction, PamStealer presents a native dialog box that requests the system password and the fuse against the MacOS PAM API. If the password is incorrect, insist until the user introduces the correct credential. This method allows attackers to obtain the real user password, not just tokens or surface confirmations.

Once the password is obtained, malware sets persistence by a binary that mimics System Settings and numbers and exfilters information to servers controlled by attackers. It also shows a fake Gatekeeper-type message that invites you to remove the application, with the intention that the victim believes that the discharge failed while the robbery already occurred.

The implications for companies and users are clear: the capture of a local login password can allow access to accounts, keychain decryption, persistent facilities and lateral movement. In addition, the use of Rust and native components reduces static signatures and noise in conventional detection systems, which complicates response and mediation.

As immediate measures, do not run scripts or applications downloaded from unverified sites. Always check the official URL before downloading software: the only official Maccy website is https: / / maccy.app and the source code is available in GitHub in https: / / github.com / p0deje / Maccy. If you receive a dialog box by asking your password out of the normal system flow or without a clear context, do not enter it; cancel and check the source of the software. Apple maintains documentation and guides about Gatekeeper and file opening that can help you understand legitimate alerts: https: / / support.

In corporate environments it is appropriate to block malicious distribution domains in DNS, apply restrictive download policies via MDM, require signed and notarized downloads, and monitor outgoing connections in search of suspicious communications to unauthorized servers. If you suspect a team was compromised, assume that local credentials and keychains may be compromised: disconnect the equipment, capture process and network evidence, rotate passwords and tokens, review browser extensions and wallet, and consider a clean reinstallation if persistence was established.

The evolution of PamStealer shows that attackers adapt their work to macOS defenses by using the system's own interface and APIs to deceive the user and validate credentials. Prevention remains the best antidote: distrust from cloned sites, restrict the execution of scripts, use physical keys or other authentication factors where possible, and maintain a detection position that includes telemetry on native processes, network activity and changes in system persistence.

If you manage incidents or want to be kept informed, see the security and technical analysis notices published by telemetry providers and software manufacturers, and place on your list of priorities the continuous user education on deception techniques that no longer depend only on obvious attachments but on subtle abuses of the system's legitimate functionality.