Loading malware…
PamStealer is a newly identified macOS infostealer discovered by Jamf Threat Labs. It is distributed via fake websites impersonating the legitimate Maccy clipboard manager, including maccyapp[.]com and maccyapp[.]net, and delivered in a malicious disk image such as "Maccy.dmg" containing a compiled AppleScript file named "Maccy.scpt." The lure instructs the victim to run the script in Script Editor, where hidden malicious logic launches a JavaScript for Automation downloader that uses native macOS APIs such as NSURLSession to retrieve a second-stage payload while avoiding more obvious tools like curl or zsh.
The second stage is a Rust-based arm64 Mach-O payload that masquerades as legitimate macOS components such as Finder.app or Software Update.app, using deceptive bundle identifiers including com.apple.finder.core, com.apple.finder.monitor, and com.apple.security.daemon. PamStealer is environment-aware: it fingerprints the host using attributes including CPU architecture, locale, keyboard layout, and time zone to derive a key that decrypts embedded configuration data, and analyzed samples were keyed to Apple Silicon systems. It also avoids execution on systems associated with Russia, Belarus, Kazakhstan, Armenia, Azerbaijan, Kyrgyzstan, Moldova, Tajikistan, Uzbekistan, Turkmenistan, Georgia, and nearby regional settings.
PamStealer steals browser data by reading SQLite databases, including stored passwords, cookies, and cryptocurrency wallet extension data; accesses Keychain-related information by dynamically loading macOS Security.framework; collects clipboard contents by repeatedly invoking pbpaste; and captures the victim's login password through a native-looking prompt claiming that Maccy wants to make changes. It validates entered passwords locally through the macOS PAM API using pam_start, pam_authenticate, and pam_end, and re-prompts until a correct password is entered. Reported targeting includes browser data, iCloud Keychain-related data, clipboard contents, wallet data, and Ethereum-related account information.
The malware establishes persistence by registering itself as a login item using both modern and legacy macOS APIs, including SMAppService and LSSharedFileList, and drops a helper executable disguised as "System Settings" to reinforce persistence. It also attempts to socially engineer the user into granting Full Disk Access through delayed fake alerts styled as Finder or system prompts. After execution, it may display a counterfeit warning that Maccy is damaged and should be moved to the Trash as a decoy.
PamStealer exfiltrates stolen data to attacker-controlled infrastructure including avenger-sync[.]live, specifically observed at avenger-sync[.]live/api/sync, using JSON requests encrypted with ChaCha20-Poly1305. Additional suspicious infrastructure mentioned in reporting includes api.sync-master[.]online, api.live-updates[.]online, avngr.netlify[.]app, and configuration references to eth.drpc.org and ethereum-rpc.publicnode[.]com. Reported forensic artifacts and indicators include fake Finder processes running from user-writable paths, repeated pbpaste execution, login items using copied Apple icons, cache data under ~/Library/Caches/com.apple.finder.core/, and the path ~/Library/Application Support/com.apple.finder.core/.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
The attack begins with a malicious disk image file named “Maccy.dmg,” which contains a compiled AppleScript file (.scpt).
Instead of relying on common command-line tools like curl or zsh, it executes a JavaScript for Automation (JXA) payload using native macOS APIs such as NSURLSession.
Он маскируется под Finder, Software Update или другие компоненты macOS, работает скрытно и закрепляется в системе.
For persistence, PamStealer registers itself as a login item using both modern and legacy macOS APIs.
The malware also tries to talk users into granting Full Disk Access... claiming that Finder had lost access to protected data and offering to open System Settings. If the user approves the fake Finder entry in the Full Disk Access pane, the stealer can read protected app data
The compiled AppleScript is a thin wrapper around a JXA payload. Although the JXA is obfuscated to slow analysis... Rather than carrying its configuration in cleartext, the dropper derives a key from a fingerprint of the host... and uses it to unlock an encrypted, integrity-checked configuration.
PamStealer is a newly identified macOS infostealer that disguises itself as the popular open-source clipboard manager “Maccy”... The script downloads a second-stage payload and installs it on the system, often masquerading as a legitimate macOS component, such as Finder or Software Update.
После этого PamStealer показывает жертве фальшивое предупреждение о том, что Maccy поврежден и его следует переместить в корзину.
One of the most notable features of PamStealer is its password harvesting technique. The malware displays a fake system prompt asking the user to enter their password.
Сначала малварь собирает данные о системе: архитектуру процессора, локаль, раскладку клавиатуры и часовой пояс.
the Rust-based Mach-O stealer begins collecting data... it can read browser-related SQLite databases... If the user approves the fake Finder entry in the Full Disk Access pane, the stealer can read protected app data, including Mail, Messages, and Time Machine backups.
One of the most notable features of PamStealer is its password harvesting technique. The malware displays a fake system prompt asking the user to enter their password.
27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
macOS infostealer targeting Apple Silicon systems. It is delivered via fake Maccy sites and a malicious AppleScript/JXA loader chain, gathers system information, downloads a Rust Mach-O payload, steals browser data, clipboard contents, iCloud Keychain data, crypto wallet extension data, Ethereum account information, requests Full Disk Access, and uniquely validates and steals the victim’s system password locally via PAM APIs.
A macOS infostealer delivered via a fake Maccy disk image. It uses a two-stage infection chain with an AppleScript/JXA dropper and a Rust-based Mach-O second stage. It steals credentials, browser passwords, cookies, wallet data, Keychain data, and clipboard contents, uses fake prompts to harvest passwords, establishes persistence as a login item, attempts to obtain Full Disk Access, and exfiltrates encrypted data to command-and-control infrastructure.
A Rust-based macOS infostealer delivered via a fake Maccy clipboard app. It validates the victim's password through macOS PAM, steals passwords, browser data, clipboard contents, and can access keychain data. It disguises itself as macOS components such as Finder.app or Software Update.app, communicates with C2 using JSON encrypted with ChaCha20-Poly1305, seeks Full Disk Access, and establishes persistence via login items.
A macOS infostealer delivered via a compiled AppleScript masquerading as Maccy. It uses a JXA downloader and a Rust-based second stage to steal credentials, browser data, cryptocurrency wallet extension data, iCloud Keychain contents, and clipboard data; it also establishes persistence and validates captured macOS passwords locally through PAM before exfiltrating data.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.