ctipilot.ch

PamStealer

tool · tool:pamstealer single-source

PamStealer — two-stage macOS infostealer impersonating the Maccy clipboard manager; validates harvested login passwords via the macOS PAM API before exfiltration (Jamf Threat Labs)

Coverage timeline
2
first 2026-07-04 → last 2026-07-05
Peak priority
notable
2 notable
Sources cited
6
6 hosts
Sections touched
2
research, weekly-research
Co-occurring entities
0
no co-occurrence
ATT&CK techniques
7
pinned v19.1 · see below
2026-07-042 appearances2026-07-05

Hunting pivots

Tags
identity ×2infostealer ×2phishing ×2espionage

ATT&CK techniques

7 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Execution TA0002

T1059.007Command and Scripting Interpreter: JavaScript×1

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation · ATT&CK page ↗

Persistence TA0003

T1547Boot or Logon Autostart Execution×1

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

Evidence: 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation · ATT&CK page ↗

Privilege Escalation TA0004

T1547Boot or Logon Autostart Execution×1

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

Evidence: 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation · ATT&CK page ↗

Stealth TA0005

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation · ATT&CK page ↗

T1497.001Virtualization/Sandbox Evasion: System Checks×1

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation · ATT&CK page ↗

Credential Access TA0006

T1555.001Credentials from Password Stores: Keychain×1

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.

Evidence: 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation · ATT&CK page ↗

T1555.003Credentials from Password Stores: Credentials from Web Browsers×1

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Evidence: 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation · ATT&CK page ↗

Discovery TA0007

T1497.001Virtualization/Sandbox Evasion: System Checks×1

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation · ATT&CK page ↗

Collection TA0009

T1115Clipboard Data×1

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Evidence: 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation · ATT&CK page ↗

Story timeline

  1. 2026-07-05The week's tradecraft converged on abusing trusted primitives — OAuth tokens, signed binaries, native auth APIs and legitimate SaaS
    weekly-researchThis week's tradecraft: abusing trusted primitives — OAuth tokens, signed binaries, native APIs, legit SaaS
  2. 2026-07-04Jamf Threat Labs documents "PamStealer": a macOS infostealer that validates the victim's password via the PAM API before exfiltrating it
    research**PamStealer** impersonates the Maccy clipboard app and confirms a stolen macOS password through pam_authenticate before sending it

Where this entity is cited

  • research1
  • weekly-research1

Source distribution

  • acronis.com1 (17%)
  • blackpointcyber.com1 (17%)
  • blog.talosintelligence.com1 (17%)
  • jamf.com1 (17%)
  • securelist.com1 (17%)
  • thehackernews.com1 (17%)

explore in graph

All cited sources (6)

Entries about PamStealer (2)

2026-07-05 · view entry permalink →

NOTABLENATOB2

The week's tradecraft converged on abusing trusted primitives — OAuth tokens, signed binaries, native auth APIs and legitimate SaaS

Five otherwise-unrelated research disclosures this week point the same direction: capable actors — from a Chinese APT to commodity BEC and ransomware crews — are increasingly operating through trusted, native mechanisms rather than dropping signatureable custom malware. For a detection-engineering audience, that is the strategic note, because it tells you where the hunt surface is moving.

OAuth tokens as the target. Kaspersky GReAT documented Umbrij, a .NET tool the ToddyCat APT uses to automate theft of Google Workspace OAuth tokens via a technique GReAT calls Shadow Token via Remote Debug (STRD) — driving Chromium's remote-debugging interface to lift live tokens (Kaspersky Securelist, 2026-06-30). Cisco Talos exposed ARToken, an EvilTokens-lineage BEC-as-a-service panel (80+ API endpoints) automating Microsoft 365 device-code phishing, Primary-Refresh-Token persistence that survives password resets, and mailbox/SharePoint exfiltration (Cisco Talos). Both defeat password-centric defences: the credential is no longer the secret worth stealing, the token is.

Signed binaries and native APIs as the execution and validation layer. Blackpoint's Avalon framework chains a signed-binary MSBuild loader with ETW/AMSI patching (in-process telemetry tampering) and the CrownX ransomware payload (Blackpoint Cyber); Jamf's PamStealer impersonates the Maccy clipboard app and confirms a stolen macOS password through the native pam_authenticate API before exfiltrating it (Jamf Threat Labs) — using the OS's own auth path to guarantee the loot is valid.

Legitimate SaaS as C2. Mustang Panda (TA416 / HIVE0154) used Zoho WorkDrive as a dead-drop C2 channel (ZOHOMURK) against government and energy targets (Acronis TRU, 2026-06-29) — command traffic riding a trusted, hard-to-block SaaS host.

Weekly takeaway: the common defensive failure mode across all five is reliance on signatures and on the password as the crown jewel. The hunt has to move to anomalous use of the trusted mechanism — remote-debugging flags on browser processes, token issuance/reuse surviving resets, signed LOLBins loading unexpected code, ETW/AMSI tampering, native auth-API calls from non-auth processes, and server egress to consumer SaaS storage. Per-tool detail and detection concepts in § references.

Builds on: 2026-07-01/kaspersky-great-toddycat-s-umbrij-automates-gmail-workspace · 2026-07-02/cisco-talos-artoken-exposes-a-full-bec-as-a-service-toolkit · 2026-07-04/avalon-framework-msbuild-etw-loader-crownx-ransomware · 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation · 2026-06-30/mustang-panda-abuses-zoho-workdrive-as-a-dead-drop-c2-channe

research05 Jul 23:34Zmulti-sourceOpen finding ↗
Sources: Kaspersky Securelist (GReAT) · Cisco Talos · Blackpoint Cyber · Jamf Threat Labs

2026-07-04 · view entry permalink →

NOTABLE

Jamf Threat Labs documents "PamStealer": a macOS infostealer that validates the victim's password via the PAM API before exfiltrating it

Jamf Threat Labs published an analysis of PamStealer, a two-stage macOS infostealer served from a typosquatted domain impersonating the legitimate Maccy clipboard-manager app (Jamf Threat Labs, 2026-07-02). The first stage is a compiled AppleScript delivered on a disk image that, rather than shelling out to curl/zsh, runs a self-contained JavaScript for Automation (JXA) downloader against native NSURLSession APIs (T1059.007) and fingerprints the host — CPU architecture, locale, keyboard layout, timezone — excluding Russian/Belarusian/Kazakh locales before proceeding (T1497.001) (Jamf Threat Labs, 2026-07-02). The second stage is an arm64 Rust Mach-O masquerading as Finder (T1036.005).

The behaviour that names the family is its credential handling: PamStealer validates the victim's typed login password through the macOS Pluggable Authentication Modules API — pam_start, pam_authenticate, pam_end — and re-prompts if validation fails, so only a confirmed-correct password is ever exfiltrated. Jamf notes the operational payoff: "the result is a quieter routine that keeps only a verified password, and one fewer process chain for defenders to detect on" (Jamf Threat Labs, 2026-07-02). It runtime-loads Security.framework to pull browser-stored credentials and Keychain data (T1555.001, T1555.003), reads the clipboard via pbpaste (T1115), and persists through both the modern ServiceManagement API and legacy shared-file-list APIs (T1547); exfiltration uses an encrypted HTTPS channel and the user is social-engineered into granting Full Disk Access (Jamf Threat Labs, 2026-07-02), a chain corroborated in secondary reporting (The Hacker News, 2026-07-03).

Rather than relying on shell commands such as curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader that retrieves and stages the payload using native Objective-C APIs.

The result is a quieter routine that keeps only a verified password, and one fewer process chain for defenders to detect on.

Jamf Threat Labs 2026-07-02
research04 Jul 06:24Zsingle-sourceOpen finding ↗
Sources: Jamf Threat Labs · The Hacker News