Back Scworld

New PamStealer variant uses server-side decryption for macOS malware | brief

Scworld • September 26, 2026

As reported by The Hacker News, a new iteration of the PamStealer malware targeting macOS has been identified, employing a sophisticated server-side decryption chain to obscure its main payload, making static analysis significantly more challenging.

The latest PamStealer variant, observed by Jamf Threat Labs, continues to use a JavaScript for Automation (JXA) dropper but has updated its lure and delivery mechanisms. Instead of embedding payload key material directly, it now fetches a dedicated decryption utility and performs a key exchange with a command-and-control (C2) server. This server-side cooperation is essential for unwrapping the payload, rendering it undecryptable without live C2 access.

Victims are lured via a fake cryptocurrency wallet website, "wavel[.]app," leading to the download of a disk image containing a compiled AppleScript. This script triggers the JXA dropper, which then decodes a base64 string and passes it to "/bin/zsh". The zsh script downloads a "pkgunpack" decryption utility, executes an X25519 key exchange, and decrypts the payload. The malware also installs multiple persistence methods, including LaunchAgents and Git hooks, to ensure its continued operation. The stealer component, now written in Swift, targets a wide range of browsers and aims to capture system passwords, steal keychain items, and collect user-centric files. The inclusion of less common browsers like Arc and Zen expands its targeting scope.

Source: The Hacker News

SC Staff September 25, 2026

SC Staff September 24, 2026

Get daily

You can skip this ad in 5 seconds

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New PamStealer Variant Targets macOS with Live C2 Decryption A new version of the PamStealer malware has been identified, which utilizes a server-side decryption mechanism to obscure its main payload, making static analysis difficult. The malware, discovered by Jamf Threat Labs, employs a JavaScript for Automation (JXA) dropper and has changed its delivery method to lure victims through a fake cryptocurrency wallet website named 'wavel[.]app.' Upon downloading a disk image file, victims execute an AppleScript that triggers the JXA dropper, which then decodes a base64 string and executes a zsh script. This script downloads a decryption utility and performs a key exchange with a command-and-control server, ensuring the payload remains undecryptable without server access. The malware installs multiple persistence methods to maintain its presence on infected systems. It targets various browsers, aiming to steal passwords and sensitive user data. 3 sources 63

Extracted Entities

New PamStealer variant uses server-side decryption for macOS malware | brief

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)