Back Ground.News

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi

Ground.News • September 26, 2026

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify the lure and the delivery method. "Where earlier variants embedded their payload key material

There is no tracked Bias information for the sources covering this story.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New PamStealer Variant Targets macOS with Live C2 Decryption A new version of the PamStealer malware has been identified, which utilizes a server-side decryption mechanism to obscure its main payload, making static analysis difficult. The malware, discovered by Jamf Threat Labs, employs a JavaScript for Automation (JXA) dropper and has changed its delivery method to lure victims through a fake cryptocurrency wallet website named 'wavel[.]app.' Upon downloading a disk image file, victims execute an AppleScript that triggers the JXA dropper, which then decodes a base64 string and executes a zsh script. This script downloads a decryption utility and performs a key exchange with a command-and-control server, ensuring the payload remains undecryptable without server access. The malware installs multiple persistence methods to maintain its presence on infected systems. It targets various browsers, aiming to steal passwords and sensitive user data. 3 sources 63

Extracted Entities

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)