New PamStealer Variant Hides Its macOS Payload Behind a Live Server Key Exchange

A new version of the PamStealer macOS infostealer can’t be fully unpacked without help from its operators’ server. Jamf Threat Labs detailed the variant earlier this week and calls it the third known version of the malware family, and The Hacker News reported on the findings Friday.

The lure has changed. Earlier versions seen in July and August posed as the Maccy, Scoppr and Nancy Clipboard apps. This one comes from a fake website, wavel[.]app, that advertises a cryptocurrency wallet called Wavel, which doesn’t exist. Its “Download for macOS” button delivers a disk image, Wavel.dmg, holding a compiled AppleScript file that opens Apple’s Script Editor with instructions that lead the victim to run a JavaScript for Automation (JXA) dropper.

That JXA code is now only a carrier. It decodes a base64 string and pipes it into zsh, and the zsh script downloads a small decryption tool called pkgunpack, performs an X25519 key exchange with the server and only then decrypts the main payload. Because a fresh key pair is generated on every run, a captured key can’t be replayed later.

“Where earlier variants embedded their payload key material directly in the JXA source, it now fetches a purpose-built decryption utility and completes a key exchange with the server before the payload can be unwrapped,” Jamf researcher Thijs Xhaflaire said. “Without the server’s cooperation, the payload cannot be recovered statically.”

Hard to remove

The dropper suppresses the macOS notification that normally appears when a new background login item is added. It installs a LaunchAgent, a repair script that restores the payload and LaunchAgent if they are deleted, and a hook in ~/.zshrc that reruns the repair script whenever a new shell opens. It also points Git’s global hooks setting at its own folder, so any git checkout or commit on the Mac silently triggers the repair script as well.

The final stealer has been rewritten in Swift; the previous version was written in Rust. It shows a fake crash dialog to capture the user’s system password and checks it through PAM, the Mac’s authentication framework, which gives the family its name. It then pulls keychain items, credentials from Chromium- and Firefox-based browsers, system details, the user’s profile photo, and files such as .zsh_history and .gitconfig.

The browser list runs from Chrome, Edge, Firefox and Brave to Arc, Zen, Yandex Browser and Cốc Cốc. “The inclusion of Arc, Zen and the less common regional and privacy-focused browsers extends the target list noticeably beyond what is typical in commodity macOS stealers,” Xhaflaire said.

Fake installers also drove a recent ClickFix campaign that pushed a fake Claude installer. In PamStealer’s case, Jamf said the live key exchange “makes static recovery of the payload significantly harder and shifts part of the operational control to the server operator.”