PamStealer: a Rust-based macOS infostealer that validates credentials through PAM

PamStealer is a two-stage macOS infostealer distributed as a compiled AppleScript impersonating Maccy, a legitimate clipboard manager, hosted on a fake domain. The first stage uses JavaScript for Automation with Objective-C APIs to download payloads while avoiding shell commands. The second stage is a Rust-based Mach-O binary that validates stolen credentials through PAM before harvesting, reads browser databases directly using bundled SQLite, captures clipboard contents repeatedly via pbpaste, and exfiltrates encrypted data using ChaCha20-Poly1305. It establishes persistence through both modern and legacy login item APIs, masquerades as Finder or System Settings, and tricks victims into granting Full Disk Access through counterfeit alerts. The stealer contacts Ethereum RPC endpoints and employs region-based exclusions targeting Apple silicon systems while avoiding Commonwealth of Independent States countries.

• Beware of Phishing Email Disguised as Quotation Inquiry (SnakeKeylogger)Malware2026-11-12
• Citrus Ransomware: tactics, techniques, procedures, and links to Toy GhoulsMalware2026-11-11
• Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 ImplantMalware2026-11-09
• Infostealer VOLTA That Has AI Assess Stolen InformationMalware2026-11-09
• Email threat landscape: Q3 2026 trends and insightsAnalysis2026-11-05