PamStealer uses macOS Script Editor burying to steal logins before sending passwords off-device

Researchers have found a never-before-seen piece of macOS malware called PamStealer, and it is built around one unusually direct goal: steal the target’s login password and then hand that credential to an attacker-controlled server. The key detail is not just that it’s an infostealer. It uses macOS-native building blocks in a way designed to look quiet while it performs authentication checks.

PamStealer is delivered in two stages. Stage one lands as a disk image that masquerades as Maccy, a clipboard manager for Macs, and it is compiled as AppleScript. When the AppleScript is double-clicked, it opens in the macOS Script Editor, where the malicious functionality is buried deep inside the file. In other words, the first thing users and defenders see is something that resembles a legitimate macOS workflow, not a flashing malware installer.

Once that first-stage script runs, the second stage kicks in. The infostealer is written in Rust, and it earns its name because it uses the Pluggable Authentication Modules (PAM) interface built into macOS to validate the target’s login password. PAM is part of macOS’s authentication plumbing, which makes the design interesting for security teams: the malware is not just scraping stored data or abusing a single browser weakness. It is performing an authentication-related validation flow, then capturing and sending the password out.

The delivery chain matters because it blends techniques that are common on macOS with a combination that is more unusual. As Ars Technica notes, both disk images and AppleScript are common in macOS malware. The twist is how PamStealer combines them to gain stealth. By embedding the malicious functionality inside the file that opens in Script Editor, it turns a tool defenders often associate with transparency into a hiding place. That is a shift in operational tempo for attackers, even if the individual components are familiar.

From an operational risk perspective, this discovery underscores the increased effort being poured into Mac infostealers. For years, many organizations built their security posture around the assumption that the biggest concentration of attacker attention was on Windows endpoints and web browsers. Mac threats have been real, but the balance is changing as attackers recognize that credentials on any platform can unlock the same downstream damages, like account takeover, lateral access, and persistence.

This is also exactly the kind of malware that pressures boards and executives to ask the boring-but-critical questions about detection and response. If the initial lure is a disk image masquerading as Maccy, then “we block downloads” is not enough. If the malicious behavior is buried inside AppleScript that opens in Script Editor, then “we scan executables” misses the point. Enterprises need coverage for the full chain: the lure, the script execution context, the suspicious use of authentication mechanisms, and the outbound traffic to attacker-controlled servers.

There is a regulatory and governance angle too, even though this story does not cite a specific enforcement action. Credential theft and exfiltration typically fall under whatever your organization calls “safeguarding personal data” and “protecting account credentials” in internal policies, and in many jurisdictions they connect to breach reporting obligations when authentication data is exposed. The second-order implication is that when macOS credential theft rises, the compliance risk rises with it, because it increases the likelihood of unauthorized access and the evidentiary burden afterward.

Second-order, this also changes how security teams think about identity and authentication controls. PAM usage inside macOS is a reminder that “authentication” is not just a backend server problem. If malware can validate or test login passwords through system interfaces, then defenses must include endpoint telemetry and incident response playbooks that treat credential-theft events as identity incidents, not just malware incidents.

For executives in security-adjacent roles, the strategic stakes are straightforward. PamStealer is not trying to crash your Macs or lock files. It tries to take passwords. That moves the game from “patch faster” to “detect faster, contain faster, and assume credentials can be stolen even when the initial file looks familiar.” If the market keeps escalating Mac infostealers with stealthy execution chains like this, the organizations that win will be the ones that treat endpoint security and identity risk as the same fight.