Cybersecurity researchers have identified a new version of PamStealer malware targeting macOS systems with enhanced delivery mechanisms, live command and control (C2) payload decryption, and multiple persistence techniques. According to Jamf Threat Labs, the updated variant continues to use a JavaScript for Automation (JXA) dropper mechanism but introduces significant changes to how the malware retrieves, decrypts, and executes its main payload. The latest version prevents the payload from being recovered through static analysis alone by requiring a server side decryption process, allowing the threat actors to maintain greater control over the malware execution chain.
Researchers found that earlier versions of PamStealer contained payload key material directly within the JXA source code, making analysis comparatively easier. In the latest variant, the malware instead downloads a dedicated decryption utility and completes a key exchange with its server before the payload can be unlocked. Security researcher Thijs Xhaflaire explained that without cooperation from the server, the encrypted payload cannot be recovered through traditional analysis methods. The updated approach relies on an X25519 key exchange mechanism, where the server holds the private key needed to complete the process. Additionally, a new ephemeral key pair is generated during every execution, preventing previously captured decryption keys from being reused to access the payload. This design makes the malware more difficult to analyze and shifts part of the operational control to the attacker managed infrastructure.
The latest PamStealer campaign also changes the method used to attract victims. Earlier variants observed in July and August 2026 used fake websites impersonating applications such as Maccy, Scoppr, and Nancy Clipboard. The newer campaign uses a fraudulent website named “wavel.app” that promotes a fake cryptocurrency wallet service called Wavel. When users select the “Download for macOS” option on the website, they receive a disk image file named “Wavel.dmg” containing a compiled AppleScript file. Opening the file launches Apple’s built in Script Editor and provides instructions that trigger the execution of the JXA dropper. Unlike previous versions where the JXA source handled encryption, framework calls, and download operations directly, the latest version uses JXA mainly as a carrier. The script decodes a base64 string and sends the output to /bin/zsh, where the decoded content is executed in the background while the original JXA process exits.
After execution, the decoded zsh script continues the infection process by downloading and launching the “pkgunpack” decryption utility from the malware infrastructure. It performs the X25519 key exchange, decrypts and stages the payload bundle, suppresses macOS notifications related to new background login items, and establishes multiple persistence mechanisms. The malware installs four redundant methods to maintain access, including a LaunchAgent, a repair zsh script that restores missing components, and a shell hook added to the user’s ~/.zshrc file that activates the repair script during new interactive zsh sessions. The repair script is also copied into Git related folders under “~/Library/Application Support/System/.githooks/” and uses the Git configuration option “git config –global core.hooksPath” to trigger execution whenever users perform Git checkout or commit operations across repositories on the affected system.
The final stage of PamStealer is written in Swift, replacing the Rust based implementation used in earlier versions while maintaining similar data theft objectives. The malware attempts to capture system passwords by displaying a fake crash dialog and validating entered credentials through a PAM based authentication approach. It can also collect keychain items, steal stored credentials from Chromium and Firefox based browsers, and target browsers including Google Chrome, Microsoft Edge, Mozilla Firefox, Brave, Vivaldi, Opera, Opera GX, Arc, Zen, Waterfox, LibreWolf, Yandex Browser, and Cốc Cốc. In addition, the malware gathers system fingerprints, user profile information, running processes, installed applications, and user related files such as .zsh_history, .zshrc, .bash_history, and .gitconfig. Researchers noted that support for less common and privacy focused browsers expands PamStealer’s targeting range beyond typical macOS infostealer campaigns. The updated variant demonstrates a continued investment in malware delivery infrastructure, using server controlled decryption and persistence techniques to make detection and analysis more challenging for security teams.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
