PamStealer: Fake Maccy App Verifies Your Mac Password First

Jamf Threat Labs has surfaced a new macOS information stealer with the unlovely name PamStealer. It poses as Maccy, a well-known open-source clipboard manager, and the way it works is worth a closer look.

The lure

The attackers stood up a lookalike site at maccyapp[.]com and packaged their payload as a disk image containing a compiled AppleScript. The on-screen instructions ask the user to open the script in Script Editor and press Cmd+R to run it. That step matters. Running a compiled script this way lets the malicious code execute even with Apple's quarantine flag still attached to the file, sidestepping a good chunk of the tightening Apple has done around Gatekeeper and Terminal over the last few releases. The malicious logic itself is tucked below a screen's worth of blank lines so a curious user opening the file sees what looks like an empty script.

Fingerprinting before it fires

Before it does anything noisy, the dropper checks its surroundings. It runs only on Apple Silicon, refuses to execute inside sandboxes, and skips machines with regional settings for Russia, Belarus, Kazakhstan and a handful of other Eastern European locales. If the host passes, it pulls down a Rust-based second stage that masquerades as Finder and starts collecting the usual haul:

• Browser data and saved credentials
• Crypto wallet browser extensions
• iCloud Keychain contents
• Clipboard history

The password trick

Here is where PamStealer earns its name. It shows a native-looking password prompt and, rather than just capturing whatever the user types, it validates the input locally through the macOS Pluggable Authentication Modules (PAM) API. If the password is wrong, it prompts again. It loops until it has a credential that actually works. No guesswork, no dud passwords sitting uselessly in an exfil log, just a verified working password every time.

Once it has one, the victim is shown a fake "Maccy is damaged and can't be opened" alert that mimics the real Gatekeeper warning almost exactly. The obvious response is to drag the file to the bin and assume it was a broken download. By that point the payload has already run and quietly installed persistence via a small binary posing as System Settings.

The bit worth remembering

Maccy is a real, legitimate app. Its developer has posted notices on both the official site and the GitHub repo pointing out that maccy.app is the only real home for it, and that anything on a similarly-named domain is not the genuine article. That is the pattern to keep in mind. Most of the people who fall for this will not be reckless. They will be someone on the team looking for a small utility to solve a small problem, clicking the first plausible result, and trusting that the download works the way it appears to.

The technical cleverness of PamStealer is real, but the door it walks through is the same one that has been open for years: staff installing their own tools, from search results, on work machines. The malware just happens to be unusually polite about which password it settles for.