Fake Crypto Wallet App Spreads PamStealer Malware to Steal Mac Passwords

A fake cryptocurrency wallet download is delivering a new version of PamStealer to Mac users. The attack starts with a convincing website whose installer asks visitors to follow instructions.

Running the disguised file starts a hidden chain that can capture the Mac login password and other personal data. This is the third known PamStealer variant.

Rather than simply hiding its harmful program inside the initial download, it relies on a live exchange with an attacker-controlled server to unlock the next stage.

That change makes the payload harder for researchers to examine without the server. Analysts from Jamf Threat Labs identified the new variant after tracking earlier PamStealer activity.

Jamf said in a report shared with Cyber Security News (CSN) that the lure now impersonates a multichain wallet instead of the clipboard tool used in the earlier PamStealer Maccy campaign, while the malware’s password-checking method remains.

In a controlled test, researchers watched the stealer assemble and upload an archive of collected information. The report gives no victim count or financial losses, so the confirmed impact is limited to observed behavior. Still, the mix of password theft, browser collection and lasting access raises serious risks for anyone who runs the installer.

Fake Crypto Wallet App Spreads PamStealer Malware

The wallet-themed site offers what looks like a normal Mac download. Its disk image instead contains a compiled script with an almost invisible name: only its file extension is shown.

Since Finder normally hides extensions, the item may look like an ordinary document until it opens in Script Editor and the user follows the instructions to run it.

That user action matters. Like the fake utility instructions targeting Macs, this attack depends on persuading someone to start the malicious sequence rather than exploiting a software flaw.

Once launched, the script decodes another script and starts it in the background, leaving the visible editor behind while the infection continues.

The background script downloads a small decryption tool and asks the attackers’ server for material needed to unlock an encrypted application.

A fresh exchange happens each time it runs, so investigators cannot simply extract the hidden program from the first download and read it offline. The dropper also removes the downloaded tool’s quarantine flag and applies an ad hoc signature before running it.

After unpacking the payload, the script installs it as a built-in Mac component. It briefly interferes with processes that would normally show a notification about a new background item.

A login task then starts the stealer again at sign-in and checks it repeatedly, while repair mechanisms can restore parts removed by a user or defender.

Password Theft And Staying Power

The main stealer is now written in Swift, replacing the Rust-based component seen in the first version. It displays a familiar-looking Mac password prompt followed by a fake damaged-app warning.

When someone enters a password, the malware checks whether it is correct through the system’s normal login validation mechanism before using it to reach protected information.

The malware can retrieve Keychain items and copy the login keychain database. It also targets credential databases across 17 browsers, including several smaller browsers beyond the usual mainstream choices.

As with other fake Mac installers, the convincing download is only the first step; the real damage follows when private material is gathered and sent away.

Researchers also found collection routines for system details, shell history and the user’s account photo. Per-browser helper applications try to access stored secrets while appearing to be the associated browser.

In the sandbox test, the program packaged its findings and sent the resulting archive to attacker-controlled infrastructure, showing that the theft chain could complete.

Removal may be complicated by a stored backup and repair triggers attached to new shell sessions and Git activity. Mac users should verify downloads and avoid unexpected scripts.

Defenders can set threat and web controls to block and report similar activity, inspect persistence, and reset exposed passwords from a clean device once the Mac is secured.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Domain	wavel[.]app	Fake wallet lure site.
URL	hxxps://y32me8[.]com/Wavel.dmg	Disk image download.
File name	Wavel.dmg	Distributed disk image.
File name	.scpt	Compiled script in the disk image.
File name	Wavel.applescript	Script name observed during analysis.
SHA-256	ed980f2fa0642b1a5ba0bca65f5b3baee8a7b3f5d149bf295aa4ac7a70b92cec	Compiled script hash.
Domain	wavel.apple03cloudstore[.]com	Payload delivery and command server.
URL	hxxps://wavel.apple03cloudstore[.]com/pkgunpack	Decryption utility download.
File name	pkgunpack	Decryption utility.
SHA-256	484129123e8509acdc733d44e9a53c1cafa5afc1e2a28d49a55d0e209806d898	Decryption utility hash.
URL	hxxps://wavel.apple03cloudstore[.]com/4e7a12e1c294f377/CoreUpdate.pkg.enc	Encrypted payload download.
URL	hxxps://wavel.apple03cloudstore[.]com/v1/loader/dek	Payload-key exchange endpoint.
URL	hxxps://wavel.apple03cloudstore[.]com/v1/loader/log	Reported server endpoint.
URL	hxxps://wavel.apple03cloudstore[.]com/v1/asset	Stolen-data upload endpoint.
URL	hxxps://wavel.apple03cloudstore[.]com/v1/asset/1789753519-10913-1182	Upload destination observed in the sandbox.
Build public key	I6VuXPzLJfPEXgVRO5ycNXdMWHWvMAkrLMV6OpEuwDw=	Embedded X25519 public key.
Upload token	be7ac520b804f933db0dc789431034eaae7b14c7ff7ff65605d736e9d5873163	Token used in server requests for this build.
Observed public key	sK2+KZYoZvdLRuLsID7OBopfce4n1fJqjVuML0SEC0Y=	Temporary public key captured during analysis.
Observed response	U05XSzG0P2XrnVk9BZr0Iu1ftcsnejIMW2JUTR3TSjRkf5F8bkEtDJiOXZHlK1rCi+OHHJI5t975CvlbCuY3NcU=	Wrapped decryption key returned during analysis.
File name	Wavel.app	Decrypted application bundle before installation.
File name	Finder.app	Installed bundle name used to resemble a system component.
File name	r8afup9un0	Swift stealer executable.
Bundle identifier	com.local.r8afup9un0	Stealer’s application identifier.
LaunchAgent label	com.apple.finder.agent	Background job posing as a system component.
File path	~/Library/Application Support/System/Finder.app/Contents/MacOS/r8afup9un0	Installed stealer executable.
File path	~/Library/LaunchAgents/com.apple.finder.agent.plist	Login persistence file.
File path	~/Library/Application Support/System/.repair-run	Persistence repair script.
File path	~/Library/Application Support/System/.sysnotif-backup.tgz	Local backup used for repair.
File path	~/Library/Application Support/System/.githooks	Directory holding malicious Git hooks.
File names	post-checkout, pre-commit	Git hooks used to trigger repair.
Shell marker	# sysnotif-repair	Marker appended to ~/.zshrc.
File path	~/.zshrc	Shell startup file modified to trigger repair.
File path	/tmp/.sn-done-be7ac520b804f933	Completion marker.
File path	/tmp/.sn-loader-be7ac520b804f933db0dc789431034eaae7b14c7ff7ff65605d736e9d5873163.lock	Loader lock file.
File path	/tmp/.pkgunpack-<PID>	Temporary decryption utility.
File paths	/tmp/.eph-<PID>.key, /tmp/.eph-<PID>.pub	Temporary keypair files.
File paths	/tmp/.core-<PID>.enc, /tmp/.core-<PID>.tar.gz	Encrypted payload and decrypted archive.
File path	/tmp/.upd-<PID>/Wavel.app/	Extracted payload bundle.
File path	/tmp/.65486b/<session>/	Staging directory for collected data.
Observed file path	/tmp/.65486b/2966269/	Staging directory seen in the sandbox.
File path	/tmp/.5ffa071d.zip.part	Archive while it is being assembled.
File path	/tmp/.5ffa071d.zip	Archive prepared for upload.
File path	/tmp/.5ffa071d.zip.lockdir	Archive assembly lock directory.
File path	/tmp/.avatar-<PID>.img	Temporary account-photo data.
File path	/var/folders/.../C/com.local.r8afup9un0/	Stealer sandbox container.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC