PamStealer macOS Infostealer Uses Rust Payload to Validate and Steal Passwords

A newly discovered macOS infostealer, dubbed PamStealer, disguises itself as the popular open-source clipboard manager Maccy while quietly harvesting credentials, browser data, and clipboard contents through a two-stage attack chain. Researchers at Jamf Threat Labs traced the malware’s name to its most distinctive trait: it validates stolen passwords locally through the macOS Pluggable Authentication Modules ( PAM ) API before exfiltrating them, avoiding the shell-based…

Diamond Model