Researchers from Jamf have described a new macOS malware named PamStealer that is delivered in two stages. The initial delivery arrives as a disk image that pretends to be the clipboard manager Maccy. The image contains an AppleScript file that, when opened in the Script Editor, executes a self‑contained JavaScript for Automation (JXA) downloader using native Objective‑C APIs. The downloader retrieves and stages a second‑stage payload written in Rust. The Rust stage implements an infostealer that uses the Pluggable Authentication Modules (PAM) interface to validate the target’s login password locally before transmitting credentials to a server controlled by the attackers. This local validation reduces reliance on network traffic that could trigger detection. Jamf noted that the AppleScript execution bypasses the com.apple.quarantine attribute, allowing the code to run without the usual macOS warnings. The malware’s first stage bundles its payload inside an application that masquerades as legitimate macOS components such as Finder or Software Update, displaying the appropriate icons to avoid suspicion. The second‑stage process encrypts its command‑and‑control communications and delays requests for Full Disk Access for up to forty minutes, preventing the activity from aligning with the system’s launch prompts. These techniques illustrate how commodity macOS stealers are evolving toward quieter execution chains and native implementations that evade traditional detection methods. The discovery underscores the continued development of stealthy macOS threats and highlights the importance of monitoring new delivery mechanisms.