PamStealer macOS Malware Uses Live Key Exchange to Evade Static A

Cybersecurity researchers at Jamf Threat Labs have identified a significant evolution in the PamStealer malware family targeting macOS systems. The latest variant introduces a sophisticated delivery and decryption mechanism that fundamentally changes how analysts can study the threat. Previously, static analysis of the payload was possible because key material was embedded directly within the malicious scripts. In this new version, the main payload cannot be recovered or decrypted without active cooperation from the attacker’s command-and-control (C2) server.

The infection chain begins with a deceptive lure. Victims are directed to a fake website called "wavel.app," which advertises a non-existent cryptocurrency wallet service named Wavel. This represents a shift from earlier campaigns that impersonated legitimate clipboard managers like Maccy, Scoppr, and Nancy Clipboard. When users click the download button on this fraudulent site, they receive a disk image file named Wavel.dmg. Inside this archive is a compiled AppleScript file designed to trick users into executing code.

Opening the file launches Apple’s built-in Script Editor, displaying instructions that prompt the user to trigger execution. This step initiates a JavaScript for Automation (JXA) dropper. However, unlike previous iterations where the JXA script performed complex decryption tasks itself, the current version uses JXA merely as a carrier. The script decodes a base64 string and pipes the result into /bin/zsh. The JXA process then exits immediately, leaving a zsh dropper running in the background to continue the infection.

This zsh script orchestrates the core technical breakthrough: live payload decryption. It downloads a purpose-built utility called "pkgunpack" from a server hosted at wavel.apple03cloudstore[.]com. The script then performs an X25519 key exchange with the attacker's server. Because the Data Encryption Key (DEK) required to unwrap the payload bundle is generated during this live exchange and held by the server, the encrypted payload remains unreadable offline. Furthermore, each execution generates a new ephemeral keypair, meaning any captured key cannot be replayed to decrypt future payloads. This design renders the encrypted payload effectively useless for static analysis without access to a live C2 session.

Beyond decryption, the malware establishes robust persistence mechanisms to ensure it survives reboots and system checks. It installs four redundant methods: a LaunchAgent, a shell hook appended to ~/.zshrc, and a repair script stored in ~/Library/Application Support/System/.githooks/. The Git hooks configuration is modified so that any git checkout or commit action silently activates the repair script, restoring the payload if it is removed. Additionally, the malware suppresses macOS notifications that would otherwise alert users to new background login items.

The final stage involves a stealer component written in Swift, marking a departure from the Rust implementation seen in predecessors. This component captures system passwords through a fake crash dialog that validates input using a PAM-based approach. It enumerates keychain items, steals credentials from a wide range of Chromium- and Firefox-based browsers including Google Chrome, Microsoft Edge, Mozilla Firefox, Brave, Vivalv, Opera, Arc, Zen, Waterfox, LibreWolf, Yandex Browser, and Cốc Cốc. It also fingerprints the system, gathers metadata, collects user-centric files like .zsh_history and .gitconfig, and lists running processes.

Thijs Xhaflaire, the security researcher who analyzed these artifacts, noted that the inclusion of less common browsers like Arc and Zen extends the target list beyond typical commodity stealers. He emphasized that this variant reflects a deliberate investment in delivery infrastructure, shifting operational control to the server operator by tying decryption to server availability. For website owners and IT teams, this highlights the importance of monitoring for unusual network connections to unknown domains and ensuring that software updates and security patches are applied promptly to mitigate such advanced threats.

AEU Hosting provides managed WordPress hosting secured end-to-end, helping site owners maintain a secure environment against various digital threats by keeping their infrastructure updated and protected.