PamStealer macOS Variant Adds Server-Dependent Decryption and Swift Infostealer
Summary
Jamf Threat Labs analyzed a PamStealer variant delivered through a fake Wavel wallet installer. Its Swift infostealer steals credentials and user data, while a live server key exchange protects the payload from static decryption.
Key points
- The fake Wavel wallet site, wavel[.]app, distributes a macOS disk image that launches a compiled JXA carrier and a zsh dropper.
- A downloaded utility uses X25519 and AES-256-GCM in a live server key exchange to decrypt the payload, preventing recovery without server cooperation.
- The second stage is rewritten in Swift and uses macOS PAM to validate captured passwords; it also accesses keychain items and browser credential databases across 17 browsers.
- The malware collects system details, selected user files, and the account profile photo, then packages and uploads the archive to its C2 server at wavel[.]apple03cloudstore[.]com.
- Persistence uses a disguised LaunchAgent and three repair mechanisms, including shell and Git hooks; the dropper also suppresses background-item notifications.
- Jamf reports successful archive assembly and upload during sandbox analysis; it says it continues to monitor the activity.
Article Details
- Attack Vectors
- Victims are lured to a fake Wavel multichain crypto wallet site and prompted to download and open a macOS disk image containing a compiled AppleScript/JXA dropper.
- The JXA layer decodes an embedded base64 script and pipes it to zsh, which downloads an encrypted payload and a decryption utility from attacker infrastructure.
- The Swift infostealer presents a fake macOS authentication prompt and validates entered passwords through PAM.
- The malware retrieves keychain items and copies the login keychain database, backs up browser credential databases, collects system information and user files, and uploads the resulting archive to its C2 server.
- Persistence is established with a LaunchAgent, a shell startup hook, global Git hooks, and a repair script with a local backup.
- Defensive Notes
- Jamf recommends configuring threat prevention, advanced threat controls, and web protection to Block and Report to help prevent execution of similar threats.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | wavel[.]app | Impersonation site used to lure victims into downloading the fake Wavel installer. |
| DOMAIN | wavel[.]apple03cloudstore[.]com | Attacker-used host serving the decryption utility and encrypted payload and receiving exfiltrated archives. |
| URL | hxxps[:]//y32me8[.]com/Wavel[.]dmg | Malicious disk-image download URL delivered from the impersonation site. |
MITRE ATT&CK
T1005 · Data from Local SystemThe infostealer collects local shell history and configuration files, the user's profile photo, and system metadata.T1041 · Exfiltration Over C2 ChannelThe dropper uploads the collected archive to its C2 server using an HTTP PUT request.T1056.002 · GUI Input CaptureThe Swift infostealer displays a fake macOS authentication prompt and captures the entered password for PAM validation.T1059.004 · Unix ShellThe decoded dropper script runs in zsh and performs the delivery, staging, persistence, and upload operations.T1105 · Ingress Tool TransferThe dropper downloads pkgunpack and the encrypted second-stage payload from its C2 host.T1140 · Deobfuscate/Decode Files or Informationpkgunpack decrypts the encrypted payload after a server-assisted key exchange.T1204.002 · Malicious FileVictims are instructed to open the downloaded disk image's compiled AppleScript/JXA file to start execution.T1546.004 · Unix Shell Configuration ModificationA repair command is appended to ~/.zshrc to run in the background on interactive zsh sessions.T1546.016 · Installer PackagesThe repair script is installed as global Git post-checkout and pre-commit hooks.T1547.015 · Login ItemsThe dropper registers a LaunchAgent that runs at login and every 15 seconds.T1555.001 · KeychainThe malware unlocks and enumerates macOS keychain items and copies the login keychain database.T1555.003 · Credentials from Web BrowsersThe malware copies browser credential databases from targeted browser profiles.T1560.001 · Archive via UtilityThe malware assembles staged collected data into a ZIP archive using ditto.T1562.001 · Disable or Modify ToolsThe dropper pauses macOS background-item notification processes around LaunchAgent registration and then kills them.