Newly discovered PamStealer isn't your typical macOS malware

Details

Jamf security researchers have documented PamStealer, a previously unknown macOS infostealer with a sophisticated two-stage delivery chain. The malware arrives as a disk image mimicking Maccy, a legitimate open-source clipboard manager. When the user double-clicks the bundled AppleScript, they are prompted to press Command-R — a move that both executes malicious code and bypasses the macOS quarantine attribute, the system flag that normally warns users about downloaded executables. The first stage deploys a JavaScript for Automation (JXA) dropper that fetches the second-stage payload using native Objective-C APIs rather than common shell tools like curl or zsh, reducing its detection surface against signature-based tools. The second stage is a Rust-compiled infostealer that masquerades as Finder in process listings, encrypts its command-and-control traffic, and deliberately delays prompting for Full Disk Access by up to 40 minutes to avoid correlation with the initial launch. PamStealer's defining tradecraft is its use of macOS's Pluggable Authentication Modules (PAM) interface to locally validate the user's login password before exfiltrating it — confirming the credential is correct before sending it to an attacker-controlled server. This unusual approach adds reliability to the attack and is where the malware gets its name. While this is a cybersecurity discovery rather than AI news per se, Mac developers and AI practitioners are a high-value infostealer target due to the API keys, cloud credentials, and model weights commonly stored on their machines.