PamStealer macOS Infostealer Uses Rust Payload to Validate and Steal Passwords

PamStealer is a macOS infostealer masquerading as the Maccy clipboard manager that uses a two-stage AppleScript/JXA and arm64 Rust payload to harvest browser databases, Keychain entries, and clipboard data; it validates stolen passwords via PAM, exfiltrates encrypted data to avenger-sync.live, employs region checks and device-fingerprinting to evade analysis, and achieves persistence through SMAppService and legacy login items.