PamStealer macOS malware: A stealthy two‑stage threat defying detection

PamStealer macOS malware reveals a new stealth vector

Security researchers have uncovered PamStealer macOS malware, a previously unseen threat that blends custom credential‑stealing code with sophisticated tradecraft to remain hidden on Apple laptops.

The infection unfolds in two stages. The initial payload arrives as a DMG file pretending to be “Maccy,” a popular clipboard manager. Inside, an AppleScript is launched; when a user double‑clicks, the script opens in the native Script Editor, where the malicious routine is nested deep within the file.

“The combination of a disk image and AppleScript is common, but the way PamStealer stitches them together is novel,” said a researcher at Reuters.

The second stage is a Rust‑written infostealer that taps macOS’s Pluggable Authentication Modules (PAM) interface to validate the victim’s login password before exfiltrating it to a command‑and‑control server.

Because the script masquerades as a legitimate utility, traditional antivirus tools often miss it, resulting in ↓ 0% detection in early tests. Analysts recommend scrutinizing DMG sources and disabling unnecessary PAM modules.

For a broader view of macOS threats, see the latest report from Bloomberg.

Dispatch from: Nova Stirling

Aerospace & Space Tech Correspondent