Newly discovered PamStealer isn't your typical macOS malware

Jamf researchers identified PamStealer’s two-stage infection process, which begins with a disk image mimicking the clipboard manager Maccy. The first stage employs AppleScript to execute a JXA downloader, leveraging Objective-C APIs to deploy a Rust-written infostealer named for its use of macOS’s Pluggable Authentication Modules (PAM) to validate stolen passwords locally before exfiltrating them. This method bypasses macOS’s com.apple.quarantine attribute by using the Command-R shortcut in Script Editor, allowing the malware to run without triggering warnings. The second stage disguises itself as Finder or Software Update components, using genuine macOS icons and delaying Full Disk Access prompts for up to 40 minutes to evade detection.

The malware reflects broader trends in macOS threat evolution, where attackers adopt native execution chains and encryption to avoid traditional detection. Unlike commodity malware relying on shell commands like curl, PamStealer’s use of JXA and Rust minimizes noise while exploiting built-in system interfaces. Jamf notes this aligns with increasing sophistication among macOS threat actors, who now prioritize stealth over brute-force tactics. The PAM interface integration is particularly concerning, as it taps into macOS’s own authentication mechanisms to verify credentials before exfiltration, reducing the risk of sending invalid data.

Organizations should monitor for disk images impersonating trusted apps, as PamStealer’s delivery method exploits user trust in macOS system components. Security teams must prioritize behavioral analysis tools to detect encrypted command-and-control traffic and delayed permission requests. Users should avoid executing unverified disk images and enable logging for Full Disk Access approvals to flag anomalies. Future variants may adopt similar “quiet” execution techniques, leveraging macOS’s native APIs to blend into legitimate processes.