Pam Stealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords

Summary: Jamf Threat Labs discovered a macOS infostealer it codenamed PamStealer, distributed as a compiled AppleScript (.scpt) file inside a disk image that impersonates the legitimate open-source clipboard manager Maccy. The dropper runs a JXA downloader that stages a Rust-based payload masquerading as Finder, which harvests browser data, cryptocurrency wallet extensions, iCloud Keychain and clipboard content, and validates the victim's login password through the macOS PAM API before exfiltrating to avenger-sync[.]live over HTTP.
Bottom line: The stealer loops its native password prompt until PAM confirms the credential is correct, then shows a fake Gatekeeper 'Maccy is damaged' alert as a decoy after persistence is already registered - so a user who dismisses the error and moves on has already handed over a validated system password.

Read the original at The Hacker News ↗

Topics: Malware
Related: ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026
Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026