PamStealer Rebuilds Its Infection Chain Behind a Fraudulent Wallet Service
A newly identified version of PamStealer is targeting macOS users through a convincing cryptocurrency-themed application while introducing a more sophisticated delivery mechanism designed to frustrate security analysis.
Jamf Threat Labs identified the malware as the third known PamStealer variant. The campaign impersonates a multichain wallet called Wavel, replacing the Maccy clipboard-manager lure associated with earlier activity.
The underlying objective remains credential and information theft, but researchers found substantial changes to how the final payload reaches an infected Mac.
Wavel Lure Turns Script Editor Into an Execution Path
Victims are directed to a fraudulent Wavel website offering a macOS download. The resulting DMG contains a compiled AppleScript whose filename is effectively hidden, leaving only its .scpt extension.
Opening the file launches macOS Script Editor. If the victim follows the attacker's instructions and runs the script, embedded JavaScript for Automation begins a hidden infection chain.
The malware subsequently downloads a purpose-built utility called pkgunpack together with an encrypted second-stage payload.
Payload Cannot Be Recovered Offline
The most significant technical change is PamStealer's new server-assisted decryption architecture.
Earlier variants carried enough key material for researchers to recover their payloads independently. The new version generates a fresh ephemeral cryptographic key pair and communicates with attacker-controlled infrastructure to complete the key exchange.
The server retains the private key required to unlock the payload's decryption key. Without cooperation from the attacker's server, researchers cannot simply extract and decrypt the final malware from the original sample.
Each execution also generates new ephemeral keys, preventing previously captured responses from being easily replayed.
Swift Payload Targets 17 Browsers
PamStealer's second stage has also been rewritten from Rust to Swift.
Jamf identified code targeting 17 browsers, including Chrome and its Beta, Dev and Canary channels, Firefox, Brave, Edge, Vivaldi, Opera, Chromium, Arc, Zen, Waterfox, LibreWolf, Yandex Browser and CocCoc.
The malware can harvest browser information and Keychain credentials while collecting shell histories and configuration data such as .zsh_history, .zshrc, .bash_history and .gitconfig.
Researchers also discovered an unusual routine capable of extracting the victim's macOS account avatar, meaning a user's actual profile photograph could potentially be included with stolen information.
Verified Mac Passwords Increase the Value of Stolen Data
PamStealer retains the technique responsible for its name: using macOS Pluggable Authentication Modules (PAM) to verify a victim's login password.
Instead of merely collecting whatever password a user enters, the malware can determine whether the credential is valid before retaining it.
Earlier Jamf analysis showed that this approach reduces noisy verification activity while ensuring attackers receive a working credential rather than an unverified password.
macOS Malware Is Moving Toward Analysis-Resistant Delivery
The campaign does not depend on a macOS software vulnerability. Its initial success still requires social engineering that persuades the victim to execute attacker-supplied code.
What has changed is the infrastructure behind that deception.
By separating the encrypted malware from the cryptographic material required to unlock it, PamStealer's operators gain greater control over when researchers—or victims—can retrieve a functional payload.
For defenders, the evolution demonstrates an increasingly important macOS threat trend:
malware developers are no longer relying solely on code obfuscation to conceal their payloads. They are moving critical parts of the infection process to attacker-controlled infrastructure, making successful analysis dependent on observing the attack while that infrastructure remains operational.