Full Breakdown
PamStealer: A New macOS Clipboard Infostealer Masquerading as Maccy
7/3/2026, 2:38:30 PM
Core Incident – Malicious Clipboard Manager Clone
Jamf Threat Labs identified a macOS infostealer named PamStealer that is distributed as a counterfeit version of the legitimate clipboard manager Maccy. Attackers host a file called `Maccy.scpt` on disk-image installers that mimic the official download page. When a user runs the AppleScript, it launches a self-contained JavaScript for Automation (JXA) downloader, which fetches a Rust-based second-stage payload. The payload validates the victim’s login password through macOS’s Pluggable Authentication Modules (PAM) before exfiltrating data.
Background – Clipboard Managers and macOS Threat Landscape
Apple introduced a native clipboard-history feature in macOS Tahoe via Spotlight, increasing demand for third-party managers such as Maccy. Disk-image and AppleScript-based malware have long existed on macOS, but PamStealer’s combination of these vectors with a native JXA dropper and Rust code represents a novel delivery surface that could affect other utilities beyond Maccy.
Technical Mechanics of the Attack
The initial AppleScript executes a JXA routine that uses native Objective-C APIs to download the payload without invoking typical shell tools like `curl` or `zsh`. The second stage, compiled in Rust, masquerades as the Finder process, encrypts its command-and-control traffic, and deliberately delays prompts—such as a Full Disk Access request—for up to forty minutes to avoid temporal correlation with the app launch. Credential harvesting occurs locally via PAM, allowing the malware to confirm passwords before transmitting them to a remote threat actor.
Key Actors – Jamf Threat Labs and Maccy Developers
Jamf Threat Labs authored the technical report that exposed PamStealer’s methodology and issued mitigation guidance. The developers of Maccy advise users to obtain the app exclusively from the official maccy.app website, the GitHub repository, or the Mac App Store, emphasizing that third-party mirrors are untrusted.
Impact and Why It Matters
By silently capturing clipboard contents and validated login credentials, PamStealer can compromise sensitive personal and corporate information. Its quiet execution chain reduces visibility to conventional antivirus solutions, raising the risk that similar tactics could be repurposed against other popular macOS utilities.
Official Statements & Responses
Jamf Threat Labs reported that PamStealer employs a self-contained JXA downloader, a Rust-based second stage, and a PAM credential-validation workflow, making detection more difficult than with traditional macOS stealers. The lab warned that the delivery method—malicious disk images paired with AppleScript—could be reused against additional macOS applications. Apple’s security guidance continues to recommend acquiring software through the Mac App Store or directly from verified developer sites, noting that the store’s vetting process mitigates exposure to malicious installers.
Criticism & Opposition
Security analysts caution that reliance on third-party download sites and cracked software dramatically increases the likelihood of encountering impersonated installers like PamStealer. They stress that user vigilance—verifying URLs and avoiding unexpected prompts—is essential to prevent compromise.
Verbatim Quotes
- “Together, these behaviors illustrate how commodity macOS stealers continue to evolve, adopting quieter execution chains and native implementations that reduce traditional detection opportunities while remaining compatible with standard macOS features.” — Jamf Threat Labs
- “Here’s the conclusion from Jamf Threat Labs: PamStealer combines a recently emerging delivery surface with a less familiar payload.” — Jamf Threat Labs
- “That second stage puts considerable effort into staying hidden, masquerading as Finder, encrypting its command-and-control traffic, and holding back prompts like the Full Disk Access request for as long as forty minutes so its activity does not line up with launch.” — Jamf Threat Labs
- “PamStealer depends on folks downloading software from unknown sources, then approving multiple prompts before the malware can complete its attack.” — Jamf Threat Labs
- “You should just download Mac apps only from trusted developers and verify website addresses before installing software.” — Jamf Threat Labs
What’s Next – Ongoing Monitoring and Mitigation
Jamf Threat Labs will continue to track variants of PamStealer and share detection signatures with security vendors. Apple is expected to refine Gatekeeper and notarization processes to better flag malicious disk-image installers. Users are urged to adopt the recommended download practices and remain alert for unsolicited prompts.
