PamStealer Mimics Maccy Clipboard Manager Silently Harvests Data and Clipboard Contents

Jamf Threat Labs identified PamStealer, a macOS infostealer masquerading as the open-source clipboard manager “Maccy.” The attack uses a socially engineered disk image containing an AppleScript dropper that runs a JXA payload to fetch a Rust-based Mach-O second-stage binary. PamStealer collects clipboard data, extracts browser databases and Keychain secrets, prompts users for passwords (validated via PAM), attempts to obtain Full Disk Access, persists via login items and helper binaries, and exfiltrates encrypted data (ChaCha20-Poly1305) to C2 domains such as avenger-sync.live; the report includes multiple IOCs and behavioral TTPs.