Jamf Threat Labs documents "PamStealer": a macOS infostealer that validates the victim's password via the PAM API before exfiltrating it
Jamf Threat Labs published an analysis of PamStealer, a two-stage macOS infostealer served from a typosquatted domain impersonating the legitimate Maccy clipboard-manager app (Jamf Threat Labs, 2026-07-02). The first stage is a compiled AppleScript delivered on a disk image that, rather than shelling out to curl/zsh, runs a self-contained JavaScript for Automation (JXA) downloader against native NSURLSession APIs (T1059.007) and fingerprints the host — CPU architecture, locale, keyboard layout, timezone — excluding Russian/Belarusian/Kazakh locales before proceeding (T1497.001) (Jamf Threat Labs, 2026-07-02). The second stage is an arm64 Rust Mach-O masquerading as Finder (T1036.005).
The behaviour that names the family is its credential handling: PamStealer validates the victim's typed login password through the macOS Pluggable Authentication Modules API — pam_start, pam_authenticate, pam_end — and re-prompts if validation fails, so only a confirmed-correct password is ever exfiltrated. Jamf notes the operational payoff: "the result is a quieter routine that keeps only a verified password, and one fewer process chain for defenders to detect on" (Jamf Threat Labs, 2026-07-02). It runtime-loads Security.framework to pull browser-stored credentials and Keychain data (T1555.001, T1555.003), reads the clipboard via pbpaste (T1115), and persists through both the modern ServiceManagement API and legacy shared-file-list APIs (T1547); exfiltration uses an encrypted HTTPS channel and the user is social-engineered into granting Full Disk Access (Jamf Threat Labs, 2026-07-02), a chain corroborated in secondary reporting (The Hacker News, 2026-07-03).
Rather than relying on shell commands such as curl or zsh, the AppleScript executes a self-contained JavaScript for Automation (JXA) downloader that retrieves and stages the payload using native Objective-C APIs.
The result is a quieter routine that keeps only a verified password, and one fewer process chain for defenders to detect on.
Defender actions
- Enforce Gatekeeper and notarization policy so unsigned or ad-hoc-signed applications launched from a mounted disk image cannot run; block AppleScript execution from quarantined/mounted images via an EDR script-control policy.
- Alert on pam_authenticate invoked by any process other than loginwindow, sudo or su in the macOS Unified Log — legitimate password validation does not originate from a downloaded binary.
- Restrict Full Disk Access grants by MDM policy and alert on new TCC.db entries for unrecognized bundle IDs, since the malware social-engineers the user into granting FDA.
ATT&CK mapping
7 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Execution TA0002
T1059.007Command and Scripting Interpreter: JavaScript
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.
Persistence TA0003
T1547Boot or Logon Autostart Execution
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.
Privilege Escalation TA0004
T1547Boot or Logon Autostart Execution
Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.
Stealth TA0005
T1036.005Masquerading: Match Legitimate Resource Name or Location
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.
T1497.001Virtualization/Sandbox Evasion: System Checks
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
Credential Access TA0006
T1555.001Credentials from Password Stores: Keychain
Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.
T1555.003Credentials from Password Stores: Credentials from Web Browsers
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.
Discovery TA0007
T1497.001Virtualization/Sandbox Evasion: System Checks
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
Collection TA0009
T1115Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.