PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence
Updated PamStealer decrypts its macOS payload only with live C2 help and adds layered persistence.
Jamf Threat Labs describes a new PamStealer macOS variant that no longer embeds its decryption key in the JavaScript for Automation dropper. Victims are lured by wavel[.]app, a fake cryptocurrency wallet, to open Wavel.dmg; the dropper downloads pkgunpack from wavel.apple03cloudstore[.]com and completes an X25519 key exchange so the payload cannot be recovered without the server. It installs a LaunchAgent, a repair script, a ~/.zshrc hook, and Git hooks, then a Swift stealer captures the system password through a fake crash dialog, reads keychain items, and steals credentials from Chromium and Firefox browsers.
- New build lures victims via a fake Wavel crypto-wallet site and Wavel.dmg.
- JXA drops a zsh script that fetches pkgunpack and completes an X25519 exchange.
- Payload cannot be decrypted without the live C2 private key.
- Persistence uses a LaunchAgent, a repair script, a zshrc hook, and Git hooks.
- Swift stealer grabs passwords, keychain items, and browser credentials.
- ATT&CK
- T1204.002 User Execution: Malicious FileT1543.001 Create or Modify System Process: Launch AgentT1546.004 Event Triggered Execution: Unix Shell Configuration ModificationT1056.002 Input Capture: GUI Input CaptureT1555.003 Credentials from Password Stores: Credentials from Web Browsers
- Vendors
- Apple
- Products
- macOS
- Malware
- PamStealer
- Organizations
- Jamf
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | apple03cloudstore.com | and invoking the "pkgunpack" decryption utility from "wavel.apple03cloudstore[.]com" Performing the X25519 key exchange Decrypting and stagin |
| domain | wavel.app | Clipboard, victims are now lured through a bogus website ("wavel[.]app") advertising a non-existent cryptocurrency wallet servic |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify the lure and the delivery method. "Where earlier variants embedded their payload key material
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.