Fake Crypto Wallet App Spreads PamStealer Malware to Steal Mac Passwords
A fake Mac crypto-wallet app delivers new PamStealer malware that steals passwords and browser credentials.
Jamf Threat Labs identified a third PamStealer variant delivered by a site impersonating the Wavel multichain wallet for Mac. A compiled script with a nearly invisible name asks the user to run it, then downloads a decryption utility and retrieves a server-supplied key for an encrypted payload. The Swift stealer shows a fake password prompt, checks the password through normal login validation, copies Keychain data, and targets credential stores in 17 browsers. In a sandbox test it archived and uploaded stolen data; login tasks and repair triggers can restore persistence. No victim count was reported.
- Third PamStealer variant impersonates the Wavel multichain wallet.
- Server-side key exchange hides the encrypted payload from offline analysis.
- Swift stealer validates the Mac password, then copies Keychain data.
- Collection covers 17 browsers, shell history, and account details.
- Login items and repair hooks restore persistence after removal.
- ATT&CK
- T1204.002 Malicious FileT1105 Ingress Tool TransferT1555.001 KeychainT1555.003 Credentials from Web BrowsersT1547.015 Login Items
- Vendors
- Apple
- Products
- macOS
- Malware
- PamStealer
- Organizations
- Jamf Threat Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | apple03cloudstore.com | d149bf295aa4ac7a70b92cec Compiled script hash. Domain wavel.apple03cloudstore[.]com Payload delivery and command server. URL hxxps://wavel.ap |
| domain | wavel.app | rs of compromise (IoCs):- Type Indicator Description Domain wavel[.]app Fake wallet lure site. URL hxxps://y32me8[.]com/Wavel.dmg |
| domain | y32me8.com | ption Domain wavel[.]app Fake wallet lure site. URL hxxps://y32me8[.]com/Wavel.dmg Disk image download. File name Wavel.dmg Distri |
| sha256 | 484129123e8509acdc733d44e9a53c1cafa5afc1e2a28d49a55d0e209806d898 | y download. File name pkgunpack Decryption utility. SHA-256 484129123e8509acdc733d44e9a53c1cafa5afc1e2a28d49a55d0e209806d898 Decryption utility hash. URL hxxps://wavel.apple03cloudstor |
| sha256 | be7ac520b804f933db0dc789431034eaae7b14c7ff7ff65605d736e9d5873163 | WvMAkrLMV6OpEuwDw= Embedded X25519 public key. Upload token be7ac520b804f933db0dc789431034eaae7b14c7ff7ff65605d736e9d5873163 Token used in server requests for this build. Observed publ |
| sha256 | ed980f2fa0642b1a5ba0bca65f5b3baee8a7b3f5d149bf295aa4ac7a70b92cec | l.applescript Script name observed during analysis. SHA-256 ed980f2fa0642b1a5ba0bca65f5b3baee8a7b3f5d149bf295aa4ac7a70b92cec Compiled script hash. Domain wavel.apple03cloudstore[.]com |
| url | https://wavel.apple03cloudstore.com/4e7a12e1c294f377/CoreUpdate.pkg.enc | a5afc1e2a28d49a55d0e209806d898 Decryption utility hash. URL hxxps://wavel.apple03cloudstore[.]com/4e7a12e1c294f377/CoreUpdate.pkg.enc Encrypted payload download. URL hxxps://wavel.apple03clou |
| url | https://wavel.apple03cloudstore.com/pkgunpack | 03cloudstore[.]com Payload delivery and command server. URL hxxps://wavel.apple03cloudstore[.]com/pkgunpack Decryption utility download. File name pkgunpack Decrypti |
| url | https://wavel.apple03cloudstore.com/v1/asset | loudstore[.]com/v1/loader/log Reported server endpoint. URL hxxps://wavel.apple03cloudstore[.]com/v1/asset Stolen-data upload endpoint. URL hxxps://wavel.apple03clo |
| url | https://wavel.apple03cloudstore.com/v1/asset/1789753519-10913-1182 | 3cloudstore[.]com/v1/asset Stolen-data upload endpoint. URL hxxps://wavel.apple03cloudstore[.]com/v1/asset/1789753519-10913-1182 Upload destination observed in the sandbox. Build public |
| url | https://wavel.apple03cloudstore.com/v1/loader/dek | c294f377/CoreUpdate.pkg.enc Encrypted payload download. URL hxxps://wavel.apple03cloudstore[.]com/v1/loader/dek Payload-key exchange endpoint. URL hxxps://wavel.apple03c |
| url | https://wavel.apple03cloudstore.com/v1/loader/log | tore[.]com/v1/loader/dek Payload-key exchange endpoint. URL hxxps://wavel.apple03cloudstore[.]com/v1/loader/log Reported server endpoint. URL hxxps://wavel.apple03clouds |
| url | https://y32me8.com/Wavel.dmg | r Description Domain wavel[.]app Fake wallet lure site. URL hxxps://y32me8[.]com/Wavel.dmg Disk image download. File name Wavel.dmg Distributed disk |
From the original article
5 min read at cybersecuritynews.com
A fake cryptocurrency wallet download is delivering a new version of PamStealer to Mac users. The attack starts with a convincing website whose installer asks visitors to follow instructions. Running the disguised file starts a hidden chain that can capture the Mac login password and other personal data.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.