Fake Crypto Wallet App Delivers PamStealer Malware That Hijacks Mac Credentials
A new PamStealer variant for macOS spreads via a fake crypto wallet, using server-assisted decryption to steal credentials, Keychain data, and crypto assets.
A new variant of the macOS infostealer PamStealer is being distributed through a fake cryptocurrency wallet application called Wavel. This version uses a Swift-based payload with server-assisted decryption, making static analysis difficult. Once executed, it steals credentials, Keychain data, browser information, and cryptocurrency wallet files, and it validates passwords using macOS PAM before exfiltration. The malware establishes persistence through multiple mechanisms, including a LaunchAgent that masquerades as a Finder component.
- A new PamStealer variant targets macOS via a fake cryptocurrency wallet app.
- The malware uses server-assisted decryption to hinder static analysis.
- It steals credentials, Keychain data, browser data, and crypto wallets.
- PamStealer validates stolen passwords using macOS PAM before exfiltration.
- Persistence is maintained through multiple layers, including LaunchAgents and modified .zshrc.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 User Execution: Malicious FileT1059.006 Command and Scripting Interpreter: PythonT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderT1555 Credentials from Password Stores
- Vendors
- Apple
- Products
- Wavel
- Malware
- PamStealerMacClient
- Organizations
- Jamf Threat Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | apple03cloudstore.com | pkgunpack from attacker-controlled infrastructure at wavel.apple03cloudstore[.]com . The lure: Wavel, a fake application installer (Source : |
| domain | finder.app | ions should block the identified domains, hunt for the fake Finder.app path and suspicious com.apple.finder.agent LaunchAgents, an |
| domain | wavel.app | ucture controlled by the attackers. The infection begins at wavel[.]app , a fraudulent website posing as a multichain cryptocurre |
| domain | y32me8.com | e. Clicking “Download for macOS” delivers a disk image from y32me8[.]com/Wavel.dmg . The DMG contains a compiled AppleScript file |
From the original article
3 min read at gbhackers.com
A new variant of the macOS infostealer PamStealer is being distributed through a fake cryptocurrency wallet application, using a server-assisted decryption chain and Swift-based payload to steal credentials, browser data, Keychain items and sensitive user files. The campaign impersonates a multichain wallet called Wavel and demonstrates a significant upgrade in both evasion and persistence capabilities. […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.