PamStealer: A Novel macOS Info-Stealer Targeting Apple Silicon Users Researchers at Jamf Threat Labs have uncovered PamStealer, a newly identified macOS information stealer that employs a unique credential-verification technique to ensure attackers receive only validated login passwords. The malware spreads via a fake website impersonating Maccy, a legitimate open-source clipboard manager, and specifically targets Apple Silicon Mac users. ### Infection Chain & Technical Sophistication The attack begins at maccyapp[.]com, a spoofed domain mimicking the official Maccy site (maccy[.]app). Victims who download the malicious disk image receive a compiled AppleScript file disguised as the clipboard tool. The first stage performs environment-aware fingerprinting, collecting system details such as CPU architecture, locale, and timezone. Only Apple Silicon devices that meet predefined criteria proceed to the second stage, reducing exposure to security analysis. Stage two delivers a Rust-based infostealer, chosen for its ability to evade static analysis tools optimized for Objective-C and Swift binaries. The payload harvests browser passwords, cookies, autofill data, cryptocurrency wallet files, and system configuration details before exfiltrating them to attacker-controlled infrastructure. ### PAM API Verification: A First for macOS Stealers PamStealer’s defining feature is its use of macOS’s Pluggable Authentication Modules (PAM) API to validate stolen credentials. When prompting victims for their login password via a native-looking dialog ("Maccy wants to make changes"), the malware internally verifies the input using pam_authenticate. Only passwords that pass this check are transmitted, ensuring attackers receive confirmed working credentials unlike traditional phishing methods that capture typos or incorrect entries. ### Targeted Users & Mitigation The campaign exploits users seeking privacy tools, particularly iCloud+ subscribers who may download software from third-party sources. The legitimate Maccy developer has issued warnings on its official site and GitHub, confirming maccy[.]app as the sole trusted download source. Users who entered their password into the fake dialog are advised to rotate credentials, revoke browser sessions, and audit cryptocurrency wallets. Jamf Threat Labs has released indicators of compromise, noting that detection at the AppleScript dropper stage is critical, as the Rust payload executes only on qualifying hosts. Security teams should monitor for compiled .scpt files in disk images from non-App Store sources and outbound connections from newly executed Rust binaries.

CrashStealer: Sophisticated macOS Infostealer Mimics Apple Utilities to Steal Credentials and Crypto Wallets In early May 2026, cybersecurity firm Jamf identified a suspicious macOS infostealer on VirusTotal, initially appearing as a work-in-progress. By July, the malware dubbed CrashStealer had evolved into an actively deployed threat, designed to harvest browser credentials, cryptocurrency wallets, password manager data, and Keychain contents before encrypting and exfiltrating the stolen information to a remote command-and-control (C2) server. Unlike typical macOS stealers built on AppleScript or Objective-C, CrashStealer is written in native C++, leveraging an internal class called MacOSData for efficiency and stealth. Its development marks a shift toward more professionalized macOS malware, aligning with trends observed in threats like Atomic (AMOS), MacSync, and Phexia though with distinct technical advancements. ### Infection Chain and Evasion Tactics CrashStealer spreads via a signed disk image ("Werkbit Setup"), a rarity in malicious DMG campaigns, which includes a notarized application bundle to bypass Gatekeeper. Upon execution, the dropper fetches an obfuscated shell script from GitHub, decodes multiple Base64 layers, and deploys the payload disguised as "CrashReporter.app" complete with Apple’s bundle identifier and icon. Once active, the malware: - Validates the victim’s login password via `dscl` - Unlocks the Keychain and profiles installed security tools - Targets Chromium-based browsers (Chrome, Brave, Edge, etc.) and Firefox for stored credentials - Steals data from ~80 cryptocurrency wallet extensions (Ethereum, Solana, Cosmos, TON, etc.) - Exfiltrates data from 14 password managers, including 1Password, Bitwarden, and LastPass - Conducts file-system reconnaissance in Documents and Downloads ### Advanced Tradecraft CrashStealer employs AES-256-GCM encryption via Apple’s CommonCrypto framework to secure stolen data before exfiltration over `libcurl`, a level of operational security uncommon in commodity macOS malware. Additional anti-analysis measures include control-flow flattening and anti-debugging checks, reflecting a broader trend of macOS threats adopting Windows-level sophistication. For persistence, the malware re-signs itself and installs a LaunchAgent (`com.apple.crashreporter.helper`), further impersonating Apple’s legitimate utilities. ### Broader Campaign Indicators Jamf linked CrashStealer to a live operator panel and additional infrastructure domains, suggesting it is part of a multi-platform operation rather than an isolated tool. This discovery underscores the rapid maturation of macOS infostealers, with detection volumes and technical complexity rising sharply since 2025.

SparkCat Infostealer Resurfaces in App Store and Play Store with Advanced Obfuscation Cybersecurity researchers at Kaspersky have identified a resurgence of SparkCat, a mobile-focused infostealer targeting cryptocurrency seed phrases, hidden within apps on both the Apple App Store and Google Play Store. Despite rigorous vetting processes by Apple and Google, threat actors successfully distributed the malware through seemingly legitimate apps, including enterprise messengers and food delivery services. First detected in 2025, SparkCat initially targeted Asian users by scanning for Japanese, Korean, and Chinese keywords in seed phrases 12- or 24-word recovery phrases used to restore cryptocurrency wallets. The malware employed Optical Character Recognition (OCR) to extract seed phrases from photos and screenshots, a tactic that previously drew attention for its sophistication. The latest version introduces new obfuscation techniques, including code virtualization and cross-platform languages, making detection significantly harder. While the Android variant continues to focus on Asian languages, the iOS version now targets English mnemonics, expanding its reach to Western users. Kaspersky reported the findings to Apple and Google, leading to the removal of some malicious apps. However, the incident highlights ongoing challenges in securing official app marketplaces against evolving malware threats.

Apple Patches Critical WebKit Vulnerabilities in iOS and iPadOS Updates Apple has released security updates addressing two critical WebKit vulnerabilities that left millions of iPhones and iPads exposed to potential attacks. The flaws, identified in the engine powering Safari and all iOS browsers, could allow malicious websites to execute harmful code, granting attackers control over devices and access to sensitive data, including passwords and payment details. The vulnerabilities were reportedly exploited in a sophisticated attack targeting specific individuals, as confirmed by Apple in late 2023. While the company released fixes in iOS 26.2 and iPadOS 26.2, adoption remains low only about 20% of users have installed the update, leaving the majority of devices at risk. WebKit flaws stem from memory-related errors, enabling attackers to exploit them simply by luring users to a compromised webpage. Since WebKit underpins all iOS and iPadOS browsers, a single vulnerability can impact millions of devices. Affected Devices: - iPhone 11 and later - iPad Pro 12.9-inch (3rd generation) and later - iPad Pro 11-inch (1st generation) and later - iPad Air (3rd generation) and later - iPad (8th generation) and later - iPad mini (5th generation) and later Apple continues to urge users to update to the latest software versions to mitigate risks, as future security releases will build on these fixes. Devices running outdated software remain vulnerable to exploitation.