PamStealer (Malware): news timeline & CVEs

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Updated PamStealer decrypts its macOS payload only with live C2 help and adds layered persistence.

Jamf Threat Labs describes a new PamStealer macOS variant that no longer embeds its decryption key in the JavaScript for Automation dropper. Victims are lured by wavel[.]app, a fake cryptocurrency wallet, to open Wavel.dmg; the dropper downloads pkgunpack from wavel.apple03cloudstore[.]com and completes an X25519 key exchange so the payload cannot be recovered without the server. It installs a LaunchAgent, a repair script, a ~/.zshrc hook, and Git hooks, then a Swift stealer captures the system password through a fake crash dialog, reads keychain items, and steals credentials from Chromium and Firefox browsers.

The Hacker NewsSep 25, 13:18 UTC · 1d agoMalware in the wild 3 sources

Fake Crypto Wallet App Delivers PamStealer Malware That Hijacks Mac Credentials

A new PamStealer variant for macOS spreads via a fake crypto wallet, using server-assisted decryption to steal credentials, Keychain data, and crypto assets.

A new variant of the macOS infostealer PamStealer is being distributed through a fake cryptocurrency wallet application called Wavel. This version uses a Swift-based payload with server-assisted decryption, making static analysis difficult. Once executed, it steals credentials, Keychain data, browser information, and cryptocurrency wallet files, and it validates passwords using macOS PAM before exfiltration. The malware establishes persistence through multiple mechanisms, including a LaunchAgent that masquerades as a Finder component.

GBHackersupdated Sep 25, 13:18 UTC · 1d agofirst Sep 23, 13:21 UTC · 3d agoMalware in the wild 3 sources

Fake Crypto Wallet App Spreads PamStealer Malware to Steal Mac Passwords

A fake Mac crypto-wallet app delivers new PamStealer malware that steals passwords and browser credentials.

Jamf Threat Labs identified a third PamStealer variant delivered by a site impersonating the Wavel multichain wallet for Mac. A compiled script with a nearly invisible name asks the user to run it, then downloads a decryption utility and retrieves a server-supplied key for an encrypted payload. The Swift stealer shows a fake password prompt, checks the password through normal login validation, copies Keychain data, and targets credential stores in 17 browsers. In a sandbox test it archived and uploaded stolen data; login tasks and repair triggers can restore persistence. No victim count was reported.

Cyber Security Newsupdated Sep 25, 13:18 UTC · 1d agofirst Sep 23, 12:44 UTC · 3d agoMalware in the wild 3 sources1

PamStealer

Timeline3 articles

Appears with

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Fake Crypto Wallet App Delivers PamStealer Malware That Hijacks Mac Credentials

Fake Crypto Wallet App Spreads PamStealer Malware to Steal Mac Passwords