Actor Profile

PamStealer is a newly discovered macOS information stealer malware family identified by Jamf Threat Labs. The malware is distributed through social engineering, masquerading as a legitimate Maccy clipboard manager application to deceive users into installation. The threat actor behind PamStealer remains unattributed, though the targeting of macOS users in the technology sector suggests a focus on high-value credentials and intellectual property. The malware's use of compiled AppleScript and PAM (Pluggable Authentication Module) exploitation demonstrates technical sophistication in targeting macOS-specific authentication mechanisms.

TTPs (Tactics, Techniques, Procedures)

PamStealer employs several macOS-specific techniques: T1036.005 (Masquerading: Match Legitimate Name or Location) by impersonating the legitimate Maccy clipboard manager application; T1059.002 (Command and Scripting Interpreter: AppleScript) using compiled AppleScript files for execution; T1056.002 (Input Capture: GUI Input Capture) leveraging PAM checks to intercept login credentials; T1555 (Credentials from Password Stores) to extract stored credentials; and T1005 (Data from Local System) to harvest sensitive data from infected macOS systems. The malware targets macOS authentication frameworks directly, exploiting user trust in legitimate productivity tools.

Targets & Patterns

PamStealer primarily targets the technology sector, focusing on macOS users who utilize clipboard management tools. The choice to impersonate Maccy—a popular open-source clipboard manager for macOS—indicates the threat actor understands the target demographic's workflow and tool preferences. Technology sector employees often handle sensitive credentials, API keys, source code, and proprietary information through clipboard operations, making them high-value targets. The malware's focus on stealing Mac login passwords suggests an objective of establishing persistent access or lateral movement capabilities within technology organizations where macOS devices are prevalent.

Historical Context

PamStealer represents an evolution in macOS-targeted information stealers, joining families like XCSSET, OSX.DazzleSpy, and Atomic Stealer (AMOS) that have increasingly targeted Apple's desktop platform. The use of PAM exploitation is relatively novel in commodity macOS malware, as most information stealers focus on browser credential stores and keychain access. The distribution method—trojanizing popular productivity applications—follows established patterns seen in campaigns distributing malware through fake versions of legitimate macOS utilities. This discovery by Jamf Threat Labs continues their track record of identifying macOS-specific threats, though no direct links to previous campaigns or threat actors have been established in available reporting.

Defensive Recommendations

  • Monitor for unsigned or improperly signed applications masquerading as legitimate tools like Maccy; verify code signatures and download sources (T1036.005)
  • Implement detection for compiled AppleScript execution (.scpt, .scptd files) from unusual locations using EDR solutions with macOS visibility (T1059.002)
  • Enable logging for PAM authentication events in /var/log/system.log and monitor for unusual authentication module queries or failures (T1056.002)
  • Deploy application allowlisting or Gatekeeper enforcement to prevent execution of unverified macOS applications, especially those requesting accessibility or input monitoring permissions
  • Educate users to download macOS applications only from the Mac App Store or verified developer websites, and to scrutinize permission requests for clipboard managers and productivity tools