Researchers at Jamf Threat Labs have documented an updated version of the PamStealer macOS malware that significantly raises the bar for analysis. Where earlier variants embedded the payload key directly in the JavaScript for Automation (JXA) dropper, this version fetches a dedicated decryption utility and performs an X25519 key exchange with the command-and-control (C2) server before the payload can be unwrapped. Because the server holds the private key and a fresh ephemeral keypair is generated on each execution, the payload cannot be recovered statically without an active C2 session.
The delivery method has also changed. Victims are now directed to a fake website advertising a nonexistent cryptocurrency wallet service called Wavel, which serves a disk image containing a compiled AppleScript file. Opening it launches Script Editor, which executes a JXA dropper that simply decodes a base64 string and pipes it to zsh. The JXA process exits immediately, and the zsh script takes over, downloading the decryption utility, completing the key exchange, and staging the payload.
Persistence is layered and unusually aggressive. In addition to a LaunchAgent and a repair zsh script that restores both the payload and the agent, the malware appends a shell hook to ~/.zshrc and copies the repair script to the Git hooks directory, setting core.hooksPath to that location. As a result, any git checkout or commit on the compromised system silently re-triggers the repair script. The final stealer component, now written in Swift instead of Rust, captures the system password via a fake crash dialog with PAM validation, harvests keychain items, and steals credentials from a wide range of Chromium- and Firefox-based browsers, including lesser-known ones like Arc, Zen, and Waterfox.