PamStealer macOS Malware Adds Live C2 Payload Decryption — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- PamStealer has been updated to fetch a purpose-built decryption utility and complete an X25519 key exchange with its C2 server before unwrapping the payload, meaning an ephemeral keypair generated each run means captured DEKs cannot be replayed for static extraction
- Jamf Threat Labs researcher Thijs Xhaflaire identified the new variant, which lures victims through a fake cryptocurrency wallet site (wavel[.]app) advertising a non-existent service called Wavel, replacing the Maccy, Scoppr, and Nancy Clipboard impersonations seen in July and August 2026 variants
- The infection chain drops the previous JXA-based RC4 decryption in favor of a zsh dropper: Script Editor decodes a base64 blob and pipes it into /bin/zsh -s, after which the JXA process exits and the zsh execution persists in the background
- PamStealer installs four redundant persistence methods — a LaunchAgent, a repair zsh script that restores both payload bundle and LaunchAgent, a shell hook appended to ~/.zshrc, and Git hooks configured globally via
git config --global core.hooksPathto a directory under~/Library/Application Support/System/.githooks/ - The stealer component has been rewritten in Swift instead of the prior Rust implementation, capturing system passwords via a fake PAM-validated crash dialog, enumerating keychain items, and exfiltrating credentials from an expanded browser list that includes Chrome, Edge, Firefox, Brave, Vivaldi, Opera, Opera GX, Arc, Zen, Waterfox, LibreWolf, Yandex Browser, and Cốc Cốc
- The payload also suppresses macOS notifications that would alert users when a new background login item is added, and it stages the stolen staging directory as a ZIP archive that is polled for and uploaded
Why it matters: For macOS incident responders, this variant makes triage materially harder: without access to the live C2 server holding the private half of the X25519 exchange, the payload cannot be decrypted and traditional static sandboxing yields nothing. The expanded browser target list — specifically Arc, Zen, LibreWolf, and regional browsers like Yandex and Cốc Cốc — signals the operators are deliberately reaching users who've migrated off mainstream browsers for privacy reasons.
Ask SkimNews
