● Covered by 1 source · 1 reportMedium impact1 negative
PamStealer macOS Malware Updates Payload Decryption and Persistence Mechanisms
Key points
- PamStealer now uses server-side decryption for its main payload.
- New lure advertises a fake cryptocurrency wallet service called Wavel.
- Malware installs four redundant persistence methods.
- Suppresses macOS notifications for new background login items.
New Decryption Method
Cybersecurity researchers have identified a new version of PamStealer macOS malware. This updated variant ensures that its main payload can only be recovered through a server-side decryption chain. Unlike earlier versions that embedded payload key material directly, the new PamStealer fetches a decryption utility and completes a key exchange with the server before the payload is unwrapped, making static recovery impossible without server cooperation.
Changed Lure and Delivery
The malware's lure has also changed. Previous versions used fake websites for applications like Maccy, Scoppr, and Nancy Clipboard. The current version uses a bogus website, "wavel[.]app," advertising a non-existent cryptocurrency wallet service named Wavel. Clicking the "Download for macOS" button on this fake site retrieves a disk image file ("Wavel.dmg") containing a compiled AppleScript file.
Execution Flow
Opening the AppleScript file launches Apple's Script Editor, which triggers a JavaScript for Automation (JXA) dropper. This JXA source acts as a carrier, decoding a base64 string and piping the result into /bin/zsh -s. The JXA process then exits, and the zsh dropper continues in the background. This zsh script downloads and invokes a "pkgunpack" decryption utility, performs an X25519 key exchange, and decrypts the payload bundle.
Multi-Layered Persistence
The updated PamStealer installs four redundant persistence methods. These include using LaunchAgent, a repair zsh script that restores the payload bundle and LaunchAgent if missing, and a shell hook appended to ~/.zshrc that triggers the repair script's execution. The malware also suppresses macOS notifications that alert users when a new background login item is added, helping it remain undetected.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
A new version of PamStealer macOS malware now uses server-side decryption for its main payload and employs a different lure, advertising a non-existent cryptocurrency wallet service. The updated malware also implements four redundant persistence methods, including suppressing macOS notifications for new background login items.