Threats Tagged 'pamstealer'

PamStealer is a macOS infostealer malware distributed as a compiled AppleScript masquerading as a legitimate clipboard manager called Maccy. It operates in two stages: the first stage uses JavaScript for Automation with Objective-C APIs to download payloads without invoking shell commands, and the second stage is a Rust-based binary that validates stolen credentials via PAM before harvesting data. The malware steals browser data, repeatedly captures clipboard contents, and exfiltrates encrypted data using ChaCha20-Poly1305 encryption. It establishes persistence using login item APIs and tricks victims into granting Full Disk Access through fake alerts. PamStealer targets Apple silicon systems while excluding certain regions such as Commonwealth of Independent States countries. There is no known patch or vendor advisory for this malware.