PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Ravie LakshmananSep 25, 2026Malware / Social Engineering

Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain.

The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify the lure and the delivery method.

"Where earlier variants embedded their payload key material directly in the JXA source, it now fetches a purpose-built decryption utility and completes a key exchange with the server before the payload can be unwrapped," security researcher Thijs Xhaflaire said in an analysis. "Without the server's cooperation, the payload cannot be recovered statically."

A second major change is the choice of the decoy itself. While previous versions observed in July and August 2026 were observed using fake websites masquerading as Maccy, Scoppr, and Nancy Clipboard, victims are now lured through a bogus website ("wavel[.]app") advertising a non-existent cryptocurrency wallet service named Wavel.

Clicking the "Download for macOS" button on the fake site leads to the retrieval of a disk image file ("Wavel.dmg") that contains a compiled AppleScript file. Opening the file launches Apple's built-in Script Editor with instructions to trigger the execution of a JXA dropper.

"In Maccy, Scoppr and Nancy, the JXA source performed RC4 decryption of an embedded payload, made Objective-C framework calls through JXA's bridge to Foundation and NSData, and managed the entire download and staging process," Xhaflaire explained.

"In Wavel, the JXA source contains none of that. The entire JXA layer is now a carrier. When Script Editor executes the file, it decodes the base64 string and pipes the result into /bin/zsh -s, where zsh reads and executes the decoded bytes from standard input. The JXA process exits immediately; the zsh dropper continues in the background."

The decoded zsh script is takes the infection forward by carrying out the following actions -

• Downloading and invoking the "pkgunpack" decryption utility from "wavel.apple03cloudstore[.]com"
• Performing the X25519 key exchange
• Decrypting and staging the payload bundle
• Suppressing macOS notifications that alert users when a new background login item is added
• Installing four redundant persistence methods via LaunchAgent, a repair zsh script that restores both the payload bundle and the LaunchAgent if not present, and a shell hook appended to ~/.zshrc that triggers the execution of the repair script on every new interactive zsh session
• Polling for and uploading the staging directory in the form of a ZIP archive

Because the server holds the private key that completes the key exchange process, the Data Encryption Key (DEK) cannot be recovered without it, thereby preventing the payload from being decrypted. Furthermore, given that a new ephemeral keypair is generated during every execution, a captured DEK value cannot be replayed to extract the contents of the payload.

This, in turn, renders the encrypted payload effectively useless for static analysis without access to a live command-and-control (C2) session.

Ephemeral key generation and a live DEK exchange

What's more, the repair script is copied to "post-checkout" and "pre-commit" folders within "~/Library/Application Support/System/.githooks/," with the Git configuration option "git config --global core.hooksPath" set to the directory. As a result, any git checkout or git commit action in any repository on the compromised system will silently activate the repair script.

The final stage is the stealer component written in Swift, marking a departure from the predecessor, which was implemented in Rust. Despite the change in the programming language used, the end goal is the same -

• Capture system password by serving a fake crash dialog and cross-checks the entered information using a PAM-based validation approach
• Enumerate and retrieve keychain items
• Steal credentials from Chromium- and Firefox-based browsers, including Google Chrome, Microsoft Edge, Mozilla Firefox, Brave, Vivaldi, Opera, Opera GX, Arc, Zen, Waterfox, LibreWolf, Yandex Browser, and Cốc Cốc
• Fingerprint the system and gather extensive metadata and user's profile photo
• Collect user-centric files like .zsh_history, .zshrc, .bash_history and .gitconfig
• List running processes and installed applications

"The inclusion of Arc, Zen and the less common regional and privacy-focused browsers extends the target list noticeably beyond what is typical in commodity macOS stealers," Xhaflaire said.

"This variant of PamStealer reflects a deliberate investment in delivery infrastructure. The pkgunpack utility introduces a live key exchange that ties payload decryption to server availability: without C2 cooperation, the second stage cannot be decrypted. That design makes static recovery of the payload significantly harder and shifts part of the operational control to the server operator."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.