New PamStealer Variant Uses Server-Side Key Exchange to Hide macOS Payload
Cybersecurity researchers have identified a new version of PamStealer, a macOS information stealer that uses a server-side decryption process to make its main payload difficult to recover through static analysis.
The latest variant continues to use a JavaScript for Automation (JXA) dropper, but changes both the delivery method and payload protection.
Earlier versions embedded the required payload key material directly in the JXA source. The new version instead downloads a dedicated decryption utility and performs a cryptographic key exchange with the server before the encrypted payload can be decrypted.
Fake Wavel Cryptocurrency Wallet
Previous PamStealer campaigns used fake websites impersonating applications such as Maccy, Scoppr, and Nancy Clipboard.
The latest campaign uses a fake website called:
wavel[.]app
The website advertises a nonexistent cryptocurrency wallet service called Wavel.
Clicking Download for macOS downloads a disk image named:
Wavel.dmg
The disk image contains a compiled AppleScript file.
Opening the file launches Apple's Script Editor and triggers the next stage of the infection.
JXA Dropper Becomes a Simple Carrier
In earlier PamStealer variants, the JXA code performed several functions, including:
- RC4 decryption
- Payload extraction
- Objective-C framework interaction
- Download and staging operations
The latest Wavel variant changes this architecture.
The JXA source now primarily acts as a carrier. It decodes a Base64-encoded string and passes the resulting data to:
/bin/zsh -s
The JXA process then exits while the background Zsh process continues the infection.
Server-Side Payload Decryption
The decoded Zsh script downloads a utility called pkgunpack from:
wavel.apple03cloudstore[.]com
The utility performs an X25519 key exchange with the remote server.
The infection process then:
- Downloads the decryption utility.
- Generates an ephemeral key pair.
- Performs an X25519 key exchange.
- Obtains the required key material from the server.
- Decrypts and stages the encrypted payload.
- Establishes persistence.
- Collects and uploads data.
Because the server controls the private key required to complete the exchange, the encrypted payload cannot be recovered without cooperation from the remote infrastructure.
A new ephemeral key pair is generated during each execution, meaning a previously captured decryption value cannot simply be reused to decrypt another payload.
This makes the encrypted second stage significantly more difficult to recover through static analysis.
Multiple Persistence Mechanisms
The malware establishes several persistence mechanisms to survive removal attempts.
These include:
- A macOS LaunchAgent
- A repair Zsh script
- A shell hook added to
~/.zshrc - Git hooks
The repair script can restore the payload and LaunchAgent if they are removed.
The malware also copies the repair script into:
~/Library/Application Support/System/.githooks/
It then configures Git with:
git config --global core.hooksPath
This causes Git operations on the compromised system to use the attacker-controlled hook directory.
As a result, operations such as git checkout or git commit can silently trigger the repair script.
Swift-Based Stealer
The final-stage information stealer is written in Swift, replacing the Rust implementation used by earlier PamStealer variants.
Despite the programming-language change, its primary objective remains information theft.
The malware can:
- Capture the system password using a fake crash dialog
- Validate entered credentials through PAM
- Enumerate macOS Keychain items
- Steal credentials from Chromium-based browsers
- Steal credentials from Firefox-based browsers
- Collect system information
- Gather the user's profile photo
- Read
.zsh_history - Read
.zshrc - Read
.bash_history - Read
.gitconfig - Enumerate running processes
- List installed applications
Expanded Browser Targeting
The stealer targets credentials from a broad range of browsers, including:
- Google Chrome
- Microsoft Edge
- Mozilla Firefox
- Brave
- Vivaldi
- Opera
- Opera GX
- Arc
- Zen
- Waterfox
- LibreWolf
- Yandex Browser
- Cốc Cốc
The inclusion of less common, regional, and privacy-focused browsers expands the malware's potential credential-theft coverage.
Why the New Design Matters
The latest PamStealer variant introduces a significant change in payload protection.
Instead of embedding everything required for decryption inside the malware, the campaign makes the remote server part of the decryption process.
Without access to the live server-side key exchange, researchers may only recover an encrypted payload rather than the executable second stage.
