PamStealer: a Rust-based macOS infostealer that validates credentials through PAM

Reported 03 Jul 2026 by otx · Severity: medium

PamStealer is a two-stage macOS infostealer distributed as a compiled AppleScript impersonating Maccy, a legitimate clipboard manager, hosted on a fake domain. The first stage uses JavaScript for Automation with Objective-C APIs to download payloads while avoiding shell commands.