Updated PamStealer macOS Malware Deploys Server-Side Decryption and Git Hook Persistence

Cybersecurity researchers have flagged a sophisticated new version of PamStealer, an information-stealing malware targeting Apple’s macOS operating system. The latest iteration introduces critical upgrades to its delivery infrastructure, moving away from static payload storage toward a server-side decryption chain. This architectural shift significantly hinders traditional static analysis and places operational control firmly in the hands of the threat actors behind the campaign.

According to recent threat intelligence findings detailed by Jamf Threat Labs security researcher Thijs Xhaflaire, the newly analyzed artifacts continue to rely on JavaScript for Automation (JXA) dropper mechanisms. However, the operators have modified both the social engineering lures and the underlying delivery methods to bypass security controls and frustrate automated analysis tools.

In earlier campaigns observed by researchers between July and August 2026, the PamStealer campaign utilized fake websites masquerading as legitimate macOS utility tools such as Maccy, Scoppr, and Nancy Clipboard. The latest variant pivots to a different social engineering approach. Victims are now lured through a fraudulent website hosted at "wavel[.]app," which actively advertises a completely non-existent cryptocurrency wallet service named Wavel.

When unsuspecting users visit the bogus site and click the "Download for macOS" button, they retrieve a disk image file titled "Wavel.dmg." Inside this disk image lies a compiled AppleScript file. Opening the file triggers Apple’s built-in Script Editor, prompting the execution of the embedded JXA dropper.

The mechanics of the JXA layer have also undergone a notable evolution. In the earlier Maccy, Scoppr, and Nancy campaigns, the JXA source code performed RC4 decryption of an embedded payload directly. It executed Objective-C framework calls through JXA’s internal bridge to Foundation and NSData, actively managing the entire download and staging process on the infected machine.

By contrast, the JXA source in the Wavel variant is remarkably lightweight and acts purely as a carrier. When the Script Editor executes the file, it decodes a base64 string and pipes the resulting output directly into /bin/zsh -s. The shell environment reads and executes the decoded bytes from standard input, causing the initial JXA process to exit immediately while the zsh dropper continues its execution silently in the background.

The most significant technical enhancement in this new variant involves how the primary payload is handled. Where earlier variants embedded their payload key material directly within the JXA source code, the new iteration fetches a purpose-built decryption utility and completes a live cryptographic key exchange with a command-and-control server before the payload can be unwrapped.

Without the active cooperation of the remote server, the payload cannot be recovered statically. A fresh, ephemeral keypair is generated during every single execution cycle, meaning that a captured Data Encryption Key value cannot be replayed to extract the contents of the payload later. Because the remote server holds the private key required to finalize the key exchange process, the DEK cannot be obtained independently, rendering the encrypted payload practically useless for static analysis without maintaining a live session with the infrastructure.

To ensure long-term persistence on compromised macOS systems, the malware employs an unconventional and stealthy technique involving Git configuration settings. The repair script associated with the infection is copied directly into "post-checkout" and "pre-commit" folders located within a hidden directory at ~/Library/Application Support/System/.githooks/. Simultaneously, the Git configuration option git config --global core.hooksPath is updated to point specifically to this directory. As a consequence of this setup, any standard git checkout or git commit action performed in any repository across the compromised system will silently activate the repair script without alerting the user.

Following the staging and persistence phases, the final stage of the attack deploys a stealer component written entirely in Swift. This marks a notable programming language shift from its predecessor, which was implemented in Rust. Despite the change in language, the core objective remains centered on harvesting sensitive data from the victim’s device, including browser data, keychain items, and local files.

Security analysts have noted that the scope of targeted applications has expanded in this latest version. The stealer explicitly reaches out to harvest data from Arc, Zen, and various regional or privacy-focused browsers, extending its target list noticeably beyond the typical boundaries seen in commodity macOS infostealers.

Researchers emphasize that this new variant of PamStealer reflects a deliberate and heavy investment in robust delivery infrastructure by its creators. The introduction of the pkgunpack utility and its live key exchange mechanism ties payload decryption directly to server availability. By ensuring that the second stage cannot be decrypted without active C2 cooperation, the developers have successfully raised the bar for security analysts, shifting a major layer of operational control away from the endpoint and directly onto the remote server operator.