PamStealer malware poses as a Mac clipboard app — and verifies your password before stealing it

Дата публикации: 06-07-2026 13:55:19

PamStealer, a fake version of the popular Maccy clipboard app, tricks Mac users into handing over a password that’s already been confirmed to work.
(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)

Основное содержимое страницы с новостью.

The “free” clipboard manager you just downloaded could be doing more than just copying and pasting text. Researchers recently found a new malware called PamStealer disguised as Maccy, a popular clipboard tool, that does something most Mac malware doesn’t bother with — checking your Mac password before sending it off.

The malware hides itself in a lookalike download for Maccy. It doesn’t just grab your password and run — but it checks the password against the same system Apple uses to log you in.

How PamStealer disguises itself as a real Mac app

Many Mac users believe they are largely safe from malware because macOS includes built-in security features such as Gatekeeper, XProtect and app sandboxing, and historically it has been targeted by fewer cybercriminals than Windows. However, that doesn’t mean Macs are immune to malware. As Apple’s market share has grown, attackers have increasingly developed malicious software specifically for macOS. And that includes PamStealer.

To spread it, attackers built a lookalike website that mirrors Maccy’s real page, according to Jamf Threat Labs. The only difference is that it hands out a disk image containing a file named Maccy.scpt.

Double-click it, and instead of installing an app, macOS opens it in Script Editor. This is where the real malicious code sits. The file tells victims to use Command-R to “install” it — triggering a hidden script that slips right past macOS’s usual download warnings.

This is how the fake Maccy app installtion looks like.
Photo: JAMF Threat Labs Why is PamStealer hard to catch?

The first stage is deliberately designed to be low-key. The malware dosen’t rely on the obvious command-line tools security software keeps a keen eye on. Instead, it uses Apple’s scripting framework to download a second payload.

Written in Rust, the payload then hides itself as Finder or Software Update, cleverly blending into background processes. Rust is rarely used by Mac malware and is notoriously hard to reverse-engineer.

The password trick makes it different

Here’s the thing that sets PamStealer apart. The malware shows a dialog that looks exactly like a normal macOS permission request: “Maccy wants to make changes. Enter your password to allow this.”

Type in the wrong password, and it asks again — because it is checking the password you typed locally against Apple’s own Pluggable Authentication Modules system. Once the password is confirmed, it shows a fake “Maccy is damaged” error. Following this, your credentials get uploaded to a remote server.

It doesn’t stop at stealing your password

From there, PamStealer settles in to your system. The malware monitors your clipboard over time and even adds itself as a login item to survive restarts. Before requesting Full Disk Access, the malware waits as long as 40 minutes — long enough that most people won’t connect the prompt to the sketchy app that was installed earlier.

Jamf researchers also found out that it fingerprints your Mac, checking for Apple Silicon, keyboard layout and time zone before deciding to proceed further.

How to stay safe?

The developer behind the real Maccy app has already posted a warning about this, confirming maccy.app is the only legitimate source to download the app.

Ands remember how the fake app asks the user to hit Command-R to “install” it? Treat any installer that asks for a keyboard shortcut to “open” as a red flag — legitimate Mac software never does that.

Plus, as a general rule, only download Mac apps from the developer’s own site, GitHub or the Mac App Store.

Схожие новости

#	Наименование новости	Тональность	Информативность	Дата публикации
1	CrashStealer malware masquerades as Apple’s crash report tool to raid your Mac	-2	7	14-07-2026
2	macOS clipboard app Maccy has a fake out there stealing passwords	-2	7	03-07-2026
3	Dangerous new CrashStealer Mac impersonates Apple's own tools — and bypasses Gatekeeper — to steal your passwords and more	-5	7	15-07-2026
4	macOS security flaw lets hackers disable Mac protection tools without a password	-5	7	25-06-2026
5	Security Bite Podcast: Atomic Stealer is blurring the line between infostealers and trojans on Mac	0	5	13-04-2026
6	Opera Adds Paste Protect Feature to Block ClickFix Clipboard Attacks in Latest Release	0	7	06-07-2026
7	9to5Mac Daily: May 14, 2026 – AI on the App Store, more	0	3	14-05-2026
8	AirPort Utility is leaving the App Store — here’s what it means for your old router	0	5	24-06-2026
9	Most beautiful Mac setups: Symmetry, style and serious desk envy	5	3	26-06-2026
10	Postřehy z bezpečnosti: malware klame analytické AI nástroje	-2	7	28-06-2026

Классификация: Пресс-релизы. Схожих патентов: 0. Схожих новостей: 10. Тональность: -5. Информативность: 6. Источник: www.cultofmac.com.