Analysis of PamStealer’s Intel Mac Build Reveals Credential Theft and Dual Persistence

Sep 29, 2026 · Original article ↗

Summary

Analysis of an in-the-wild Intel x86_64 PamStealer sample finds credential and browser-data theft, crypto clipboard substitution, dual persistence, Ethereum-based C2 resolution, and anti-analysis checks. Attribution to Russian/CIS-linked cybercriminals is moderate-conf

Key points

Telemetry identified an x86_64 PamStealer sample in late August 2026; it is one architecture slice of a fat binary that also includes an arm64 slice.
A fake password prompt validates entered passwords against macOS PAM before sending credentials to the operators; the stealer also targets browser data and messaging databases.
The malware monitors the clipboard and replaces copied cryptocurrency addresses with attacker-controlled addresses.
It establishes login persistence through both SMAppService and a decrypted helper using legacy LSSharedFileList, so cleanup may need to check both mechanisms.
For command and control, it retrieves encrypted configuration through Ethereum JSON-RPC calls to ERC-20 name() records, then sends encrypted data over HTTPS and can load native modules in-process.
Anti-analysis measures include debugger and virtualization checks, environmental keying, and geofencing that excludes Russian and CIS locations; attribution to a financially motivated Russian/CIS-linked syndicate is moderate-confidence.

Article Details

Attack Vectors: Prior public analysis reported delivery through trojanized disk images impersonating Maccy; the analyzed Intel payload is a slice of a multi-architecture fat binary.
A persistent password dialog captures user credentials and validates them through the local PAM authentication stack before exfiltration.
A dialog using the genuine Finder icon falsely claims Finder lost access to protected data and directs the victim to grant Full Disk Access.
The malware reads browser credential stores, messaging databases and targeted local files, subject to applicable access permissions.
Clipboard monitoring replaces cryptocurrency payment addresses with attacker-controlled addresses.
An operator-controlled task envelope directs the malware to download native modules and execute their entry points inside its own process.
Defensive Notes: Detection coverage should account for both Intel and Apple Silicon slices; architecture-specific hashes, code-signing hashes and byte signatures differ.
Complete persistence removal requires checking both modern service registrations and legacy shared-file login lists. Removing only the modern registration can leave the helper intact on systems supporting legacy login lists.
A hunt limited to ~/Library/LaunchAgents can miss this sample's persistence; researchers found no LaunchAgent plist path in the image.
Full Disk Access requires the victim to enable the setting; researchers found no exploit that grants it automatically. Browser profile theft and clipboard substitution can proceed without that grant.
Downloaded modules execute inside the existing malware process, so process-creation telemetry does not show a separate module launch.
TLS inspection exposes an application/json POST containing a single data field, but the inner record remains encrypted.
The configuration seed can be reconstructed statically because its initial value and all eight contributing constants are compiled into the binary.
Researchers did not test whether the legacy helper successfully registers a login item on macOS 13 or later.

Indicators of compromise

Type	Indicator	Context
SHA256	`29ef90f7a64dda3d8bfdb873914a8f89b9c8b5acb5c1f829c94f8f766447f35c`	SHA-256 of the decrypted 15,744-byte embedded login-item helper; the article states it is recompiled per build.
SHA256	`9ac76794c37798420a052fbe21066f8e790ba4574f540543bb6e924a1e3d47d7`	SHA-256 of the analyzed PamStealer x86_64 Mach-O sample.
URL	`hxxps[:]//flylikeabirdmyhoneypie[.]com/api/sync`	Primary C2 endpoint receiving encrypted, base64-encoded records through application/json POST requests.