This Fake Mac App Is Quietly Stealing Your Password — And It Checks If It Works Before Moving On
Most malware grabs your password and hopes for the best. This one stops, verifies your credentials actually work, and only then continues stealing everything else. That's a level of patience most Mac users weren't expecting from something that arrived disguised as a clipboard manager.
If you use a Mac and you've ever downloaded a third-party productivity app from somewhere other than the Mac App Store, this one is worth reading to the end. Jamf Threat Labs published a full technical report yesterday — July 2nd, 2026 — detailing a piece of macOS malware that's been circulating quietly and doing something genuinely unusual compared to the infostealers that have come before it. They've named it PamStealer. It's sophisticated in a specific, deliberate way, and understanding how it actually works is the fastest path to understanding whether you're at risk.
What PamStealer Is Pretending to Be
Maccy is a legitimate, widely used open-source clipboard manager for macOS. If you've ever copy-pasted multiple things in a row and wished your Mac remembered the earlier ones, Maccy is the kind of app that solves that problem — it keeps a history of your clipboard so you can pull up anything you copied recently without losing it to the next thing you copy. It's free, well-reviewed, and has a small but dedicated user base of developers, writers, and power users who find it genuinely useful.
PamStealer is using Maccy's identity as a vehicle. Its operators built websites designed to look like Maccy's legitimate homepage, close enough that someone who found the link through a search result or an unfamiliar referral wouldn't necessarily flag anything wrong. Users who visit these fake sites and attempt to download what they believe is a clean copy of Maccy instead receive a malicious file engineered to compromise their system without announcing itself at any point in the process.
The Two-Stage Attack: Why It's Harder to Catch Than Most
PamStealer doesn't arrive as a single executable that antivirus tools can flag by matching against a known signature database. It arrives in two stages, and the way those stages are constructed is specifically designed to avoid the patterns security tools have been trained to detect.
The first stage is a compiled AppleScript file — the kind of file format associated with macOS automation, legitimate enough that many security tools treat it as low-risk. Once a victim opens this file, it doesn't immediately do anything visibly malicious. Instead, it uses a JavaScript for Automation downloader built from native Objective-C APIs — tools that are part of macOS's own legitimate software framework — to quietly reach out to an attacker-controlled server and pull down the second stage payload.
The deliberate choice of native APIs here matters. Most Mac security tools have been trained to flag specific shell commands — curl, zsh, and similar utilities that earlier generations of macOS malware relied on heavily to download and execute additional code. PamStealer sidesteps that detection layer entirely by using the same programming interfaces Apple ships as part of macOS itself. Nothing in stage one looks obviously suspicious to conventional monitoring because nothing in stage one is using the tools those monitors are watching for.
The second stage is a Rust-based binary — an actual infostealer that handles the credential theft, data collection, persistence, and exfiltration once it lands on the machine. Rust is increasingly common in sophisticated malware precisely because it's harder to reverse-engineer than code written in more familiar languages, and Jamf's researchers described the combination of stage one and stage two as producing a notably quiet attack chain that creates very little noise in the kind of logging that would normally surface suspicious behavior.
The Part That Makes PamStealer Different From Most Mac Infostealers
Here is the specific behaviour that earned this malware its name and separates it from the broader landscape of Mac-targeting infostealers that have appeared over the past couple of years.
Most infostealers that target login passwords operate on a simple capture-and-send model. They trick the user into entering a password — usually through a fake system dialogue box — record whatever gets typed, and send it back to the attacker without any further verification. Whether that password is correct, whether the account it belongs to actually exists, whether it's even a real credential rather than a frustrated string of random characters a user typed to dismiss an annoying popup — none of that gets checked. The attacker's server receives whatever was captured and deals with the quality problem later.
PamStealer doesn't do that. After capturing the login password, it passes that credential through macOS's own Pluggable Authentication Modules framework — the same authentication system macOS uses internally to verify passwords when you unlock your Mac, approve a software installation, or authenticate a system change. PAM validates whether the submitted password is actually correct for the account it claims to belong to. If the password fails validation, PamStealer knows immediately and can act accordingly. If it passes, PamStealer has confirmed it holds a working credential before proceeding to the next phase of data collection.
Jamf's researchers called this out as genuinely unusual. The practical implication for attackers is significant: rather than passing thousands of potentially incorrect passwords to backend infrastructure that then has to sort through them, PamStealer delivers pre-validated credentials. The attacker receives confirmed working logins, not a pile of guesses. That changes how valuable each infection is to whoever is operating the campaign.
What It Actually Steals
Once the password validation step completes, the Rust-based second stage gets to work on a broader collection operation. Based on Jamf's analysis of the payload's behaviour, PamStealer targets several categories of data simultaneously.
Browser data is a primary target — saved passwords, session cookies, browsing history, and autofill information stored by Chrome, Safari, Firefox, and other Chromium-based browsers. Session cookies are particularly valuable to attackers because they can be used to access logged-in accounts directly without needing the original password — a technique that bypasses two-factor authentication entirely, since the session is already authenticated.
The malware also targets clipboard contents specifically — consistent with its cover as a clipboard management tool, and likely not coincidental. Clipboards on developer and productivity-focused Macs frequently contain API keys, authentication tokens, database credentials, and private keys that users copy temporarily during normal work. Those types of credentials don't typically end up in browser password managers, which makes the clipboard a valuable secondary collection target beyond the standard credential theft approach.
PamStealer also attempts to establish persistence — mechanisms that allow it to survive a system restart and continue running on subsequent sessions rather than being limited to a single infection window. And before sending any collected data back to attacker-controlled infrastructure, it encrypts the package, which makes interception-based detection significantly harder and ensures the data arrives at its destination intact and readable only to whoever holds the decryption key.
In one particularly notable behaviour, the malware requests Full Disk Access — a macOS permission that grants broad read access across the filesystem, including locations that would otherwise be restricted. How it handles that request in terms of user-facing prompts hasn't been fully detailed in the current report, but the request itself is a significant red flag that the permission review section below addresses directly.
Why This Fits a Broader Pattern That Mac Users Need to Understand
PamStealer didn't appear in a vacuum. The broader landscape of macOS-targeting malware in 2026 has shifted in a direction that security researchers have been tracking with increasing concern — away from unsophisticated campaigns that rely on obvious tricks, toward professionally constructed operations that abuse macOS's own legitimate features to stay invisible.
The use of native macOS APIs to avoid detection. The choice of Rust for the payload to complicate reverse engineering. The PAM validation step that reflects a genuine understanding of how macOS authentication works internally. The fake website that closely mimics a real, trusted application's homepage. None of these are the hallmarks of an amateur operation. This is a campaign built by people who have studied macOS security architecture specifically to work around it.
That matters because the old mental model — that Macs don't get viruses, or that the risk is low enough to treat as theoretical — is genuinely outdated in a way that has practical consequences for anyone relying on it as a reason not to think carefully about what they download.
How to Check If You're at Risk Right Now
If you use Maccy and you downloaded it recently, the first thing to do is verify where the download came from. The only legitimate sources for Maccy are the official website at maccy.app and the project's GitHub repository. If you downloaded from any other URL — a link from a search result, a third-party software directory, a recommendation in a forum thread — that download should be treated as suspect until you can verify it.
If you installed something claiming to be Maccy and you're unsure of the source, check System Settings → Privacy & Security → Full Disk Access and look for anything that shouldn't be there. PamStealer requests this permission as part of its operation, and an unfamiliar application holding Full Disk Access on a Mac is a meaningful signal worth investigating.
Review your Login Items under System Settings → General → Login Items & Extensions for anything you don't recognize — persistence mechanisms added by malware frequently show up here, and unfamiliar entries that survive restarts are one of the cleaner ways to spot something that's established itself beyond a single session.
Jamf has confirmed that its own security products detect PamStealer. If you're on a managed Mac through a workplace, your IT team should be across this already. If you're a personal Mac user without any dedicated security software, this incident is a reasonable prompt to reconsider that setup.
The Safest Path Going Forward
Jamf's immediate guidance is specific and practical. Download Maccy exclusively from maccy.app or the official GitHub repository, not from any third party. Be genuinely suspicious of any macOS application that requests Full Disk Access unless you have a clear, specific reason to understand why that permission is necessary for what the app does. And treat the Mac App Store's sandboxed distribution as meaningfully safer than downloading from the open web for any application where a Mac App Store version exists — the review process isn't perfect, but it eliminates the fake-website distribution vector that PamStealer relies on entirely.
The broader point is the one that applies beyond this specific malware: the attack surface on macOS has grown enough in 2026 that treating your Mac as inherently safer than Windows or Android by default is a posture that no longer reflects the actual threat landscape. PamStealer is sophisticated precisely because it was built by people who understand that, and built to exploit it.
Also read: iPhone 18 Pro release- Everything you need to know
