Cybersecurity
PamStealer gains live decryption and persistence
Jamf Threat Labs said a new PamStealer build fetched a server-controlled decryption utility, used a fake Wavel site for delivery and added several persistence paths on macOS.
- Jamf Threat Labs said a new PamStealer version needed a server-controlled decryption process before its payload could be recovered.
- Thijs Xhaflaire said the updated JXA layer fetched a decryption utility and completed an X25519 key exchange before the payload was unwrapped.
- The lure used a bogus Wavel website and a Wavel.dmg disk image that opened Script Editor and launched the dropper.
- The final stage was a Swift stealer that collected passwords, keychain items, browser credentials, system metadata and user files.
Jamf Threat Labs said the latest PamStealer artefacts still used a JXA-based dropper, but the code now fetched a separate decryption utility and negotiated a key exchange with the server before the payload was released. The researchers said that without the server's private key, the encrypted stage could not be recovered from the file alone.
The lure had shifted from earlier fake sites linked to Maccy, Scoppr and Nancy Clipboard to a bogus Wavel site advertising a non-existent cryptocurrency wallet. Clicking the download button retrieved Wavel.dmg, which opened Script Editor and then passed a decoded JXA dropper into zsh.
The zsh script downloaded pkgunpack from wavel.apple03cloudstore[.]com, performed the X25519 exchange, decrypted and staged the payload bundle, and suppressed notifications about new background login items. Jamf said it also set up multiple persistence methods, copied a repair script into git hook folders, pointed git configuration at that directory, and added a shell hook in ~/.zshrc to relaunch the repair logic in new interactive sessions.
The final payload was a Swift stealer rather than the earlier Rust version. Jamf said it captured system passwords through a fake crash dialog, retrieved keychain items and browser credentials, fingerprinted the system, gathered profile photos and user files, and listed running processes and installed applications.
Named in this story
People
- Thijs Xhaflaire
- described the updated infection chain in an analysis
Organisations
- Jamf Threat Labs
- reported on the latest artefacts
Products and systems
- PamStealer
- was the macOS malware family examined
- Wavel
- was the bogus cryptocurrency wallet service used as the lure
- Script Editor
- opened the dropped file and started execution
- pkgunpack
- was the decryption utility fetched from the remote host
- Google Chrome
- was among the browsers targeted for credential theft
- Microsoft Edge
- was among the browsers targeted for credential theft
- Mozilla Firefox
- was among the browsers targeted for credential theft
- Brave
- was among the browsers targeted for credential theft
- Vivaldi
- was among the browsers targeted for credential theft
- Opera
- was among the browsers targeted for credential theft
- Opera GX
- was among the browsers targeted for credential theft
- Arc
- was among the browsers targeted for credential theft
- Zen
- was among the browsers targeted for credential theft
- Waterfox
- was among the browsers targeted for credential theft
- LibreWolf
- was among the browsers targeted for credential theft
- Yandex Browser
- was among the browsers targeted for credential theft
- Cốc Cốc
- was among the browsers targeted for credential theft
How the source tells it
The article read as a technical threat-analysis report, with little overt emotional colouring.
No emotive framing was found in the original.