New macOS Malware Aims to Empty Cryptocurrency Wallets

• Apple users who store or manage cryptocurrencies are facing a new cybersecurity threat. Researchers from Jamf Threat Labs, the cybersecurity research team, have discovered a campaign distributing a fake version of the open-source application Maccy, aimed at installing PamStealer, malware designed to steal passwords, credentials, and keys from cryptocurrency wallets.

According to the firm's report, attackers use a website that mimics the official Maccy site, a free clipboard manager for macOS, to convince victims to download a malicious disk image. When the file is opened, it displays instructions to run it from the Apple Script Editor while keeping the malicious code hidden that initiates the infection.

Once on the system, the malware verifies the user's login password using the Pluggable Authentication Modules (PAM) of macOS. It then downloads a second payload developed using native tools of the operating system, a technique that reduces the chances of being detected by security programs.

The malware also generates a key based on device information, such as processor architecture, regional settings, keyboard layout, and time zone. This key unlocks an encrypted configuration containing the necessary instructions to continue the attack.

If the infection is successful, the malware can steal passwords stored in browsers, data from the macOS keychain, information copied to the clipboard, and credentials related to cryptocurrency wallets. Additionally, it establishes persistence on the machine and sends the stolen data to a remote server via encrypted communications.

As part of the attack, the program also displays a fake window to a file explorer requesting full disk access. Notably, this prompt can appear up to 40 minutes after installation, making it difficult for the user to associate the request with the initial download. If permission is granted, the malware gains access to protected information, including emails, messages, and Time Machine backups.

The firm explained that this type of campaign primarily relies on social engineering. According to Jaron Bradley, director of Jamf Threat Labs, cybercriminals purchase ads on platforms like Google Ads and X to direct users to fake pages that appear to offer legitimate applications. The company added that it recently detected another sponsored ad on X distributing a variant of the Atomic Stealer malware through a verified account, increasing the credibility of the deception.

Although the company stated that it has not yet found evidence of PamStealer being actively used, it has already notified Apple of its findings. So far, the company has not issued any public comments on the case.

Researchers conclude that this campaign reflects a growing trend among cybercriminals: disguising malware as legitimate software and leveraging trusted platforms to distribute it. A report from the research firm TRM Labs indicated that in 2026 there was an increase in the number of attacks, with total losses of USD 972 million, as reported by CriptoNoticias.

For cryptocurrency users, these threats pose a significant risk, as the theft of credentials or wallet keys can lead to irreversible loss of digital funds.