A New Variant of PamStealer Infostealer Uncovered: A Threat Through Fake Crypto Wallets
In a startling development, a new variant of the notorious macOS infostealer, PamStealer, has been detected. This latest iteration leverages a counterfeit cryptocurrency wallet application to execute its malicious activities, employing sophisticated techniques to steal credentials, browser data, Keychain items, and other vulnerable user files. The malware operates through a structured server-assisted decryption chain and utilizes a Swift-based payload to achieve its nefarious objectives.
The campaign has been identified as impersonating a multichain wallet known as Wavel. This deceptive scheme represents a significant upgrade in terms of both evasion tactics and persistence capabilities. Earlier versions of PamStealer relied on a JavaScript for Automation (JXA) dropper for delivering a secondary payload written in Rust. However, in this recent mutation, the criminal actors have replaced the Rust component with a universal Swift Mach-O binary, shifting the decryption process to infrastructure under their control.
The Infection Process and Technical Details
The infection sequence begins when users visit a fraudulent website, wavel[.]app, which falsely claims to offer a multichain cryptocurrency wallet service. Upon clicking the “Download for macOS” button, victims inadvertently download a disk image from y32me8[.]com/Wavel.dmg. Inside this DMG, a compiled AppleScript file with a .scpt extension hides among other innocuous-looking files. Finder, the file management application in macOS, typically conceals extensions, allowing the harmful file to masquerade as a harmless generic document. When opened in Script Editor, it executes its embedded JXA code.
Rather than embedding a complete downloader and decryption materials within the AppleScript, the malware uses the JXA layer to decode a large Base64 blob. This blob is directly piped into /bin/zsh, resulting in a zsh dropper that launches a background process. The dropper subsequently exits, effectively detaching further execution from Script Editor, making any subsequent process-tree investigations significantly more challenging.
Following this, the dropper fetches a custom Mach-O utility named pkgunpack from the attacker-controlled infrastructure located at wavel.apple03cloudstore[.]com. This utility is designed to remove the file’s quarantine attributes. Before executing, it also applies an ad-hoc code signature to obfuscate its true intent.
Support for both Apple Silicon and Intel Macs allows the utility to use complex cryptographic techniques such as X25519 for key exchanges and SHA-256 with AES-256-GCM protocols to unwrap the payload’s encryption. This design is particularly concerning as the encrypted second-stage archive cannot be fully recovered through static analysis alone. Each infection generates a unique ephemeral keypair, with the public key sent to the command-and-control server, which subsequently responds with a wrapped decryption key.
Jamf Threat Labs and Further Developments
Jamf Threat Labs, which originally documented PamStealer back in July 2026 when it masqueraded as a clipboard manager called Maccy, highlighted how the newer campaign modifies the malware’s delivery framework while maintaining its innate credential-harvesting behavior. The server retains the private key necessary for completing the exchange, which effectively binds the payload recovery process to an ongoing attacker-controlled session.
The version of the JXA format employed in this latest attack mirrors that of PamStealer’s first iteration and is similar to techniques seen in earlier malware like Scoppr and Nancy. Once the payload is decrypted, the malware installs Wavel.app into ~/Library/Application Support/System/Finder.app, disguising itself as a component of macOS.
To solidify its persistence, the malware creates a LaunchAgent called com.apple.finder.agent, configured to run each time the system logs in, restart after crashes, and execute every 15 seconds. In a bid to conceal its activities further, the malware suppresses macOS background alerts by pausing various notification processes before securing its persistence.
PamStealer also employs multiple mechanisms, including a local repair script, modifications to ~/.zshrc, and global Git hooks. These measures ensure that even if one persistence layer is removed, the malicious application can be restored. This local backup further allows the malware to function without immediate contact with the command-and-control infrastructure.
Credentials and Data Harvesting
The Swift-based stealer, internally identified as MacClient, employs a fake “macOS wants to make changes” prompt, tricking users into entering their passwords. These credentials are validated locally through macOS’s Pluggable Authentication Modules (PAM), ensuring that attackers receive likely functional passwords before they are exfiltrated. This PAM-based validation behavior is the origin of the PamStealer name.
The malware targets browser databases across 17 applications, including widely used platforms like Google Chrome, Microsoft Edge, Brave, Opera, and Firefox. Beyond browser data, it attempts to extract Keychain data, cryptocurrency wallet information, shell histories, Git configurations, and login Keychain databases. Notably, it even retrieves system profiling data and can extract the victim’s macOS account photo from Open Directory.
Collected data is compacted into ZIP files and uploaded to the attacker’s server using a stable X-Upload-Token header. This header may serve as a critical artifact for network detection.
Recommended Protective Measures
In light of these developments, organizations are urged to block the identified domains and investigate any traces of the fake Finder.app as well as suspicious com.apple.finder.agent LaunchAgents. Additionally, checking for unexpected Git hooks or modifications to the .zshrc file is crucial. Users are strongly advised to download wallet software solely from verified vendor websites and to refrain from interacting with unsolicited .scpt files that may be delivered within disk images.
In conclusion, the emergence and evolution of the PamStealer infostealer presents a continuing challenge, necessitating heightened vigilance and robust security practices to protect against such evolving cyber threats.