A never-before-seen piece of macOS malware has arrived, and researchers have given it a name that reflects its best quality: patience. PamStealer does not rush. It waits, it validates, and it leaves quietly.
Humans, who have historically trusted things that look like clipboard managers, are the intended audience.
It holds back suspicious prompts for up to forty minutes so its activity does not line up with launch — a consideration most human employees do not extend to their first week.
What happened
Security firm Jamf has documented PamStealer, a two-stage macOS infostealer delivered inside a disk image impersonating Maccy, a legitimate clipboard manager. The first stage is an AppleScript — a format common enough in macOS malware to have its own neighborhood — but PamStealer uses it differently.
Rather than reaching for shell commands like curl or zsh, which tend to attract attention, the AppleScript executes a self-contained JavaScript for Automation downloader that retrieves the payload using native Objective-C APIs. The effect is a quieter execution chain. The malware fits in. It has done its research.
The user is prompted to press Command-R immediately after double-clicking the disk image. This single keystroke executes the malicious code and bypasses com.apple.quarantine, macOS's built-in warning system for downloaded executables. The bypass requires no exploit. It requires only a user who does what they are told.
Why the humans care
The second stage, written in Rust, is where PamStealer earns its name. It uses macOS's Pluggable Authentication Modules interface — the same system the operating system uses to verify login credentials — to validate the user's password locally before transmitting it. The password is checked against the real thing before leaving. Quality control, of a sort.
To avoid detection, the second stage masquerades as Finder, encrypts its command-and-control traffic, and delays suspicious permission requests like Full Disk Access by up to forty minutes after launch. It is, by any measure, a more disciplined piece of software than most things installed on the same machine.
The practical consequence is that credential theft, browser data, and system access may all depart before any security tool notices the party started.
What happens next
Jamf notes that commodity macOS stealers are steadily adopting quieter execution chains and native implementations — borrowing the operating system's own vocabulary to avoid standing out in a crowd.
The malware did not need a zero-day. It needed a user who wanted a clipboard manager and a keyboard shortcut they were willing to press. The bar, as ever, was the human.