PamStealer macOS Malware Gets Harder to Analyse, Now Poses as Crypto Wallet App

Researchers at Jamf Threat Labs have identified an updated version of PamStealer, a macOS information-stealing malware, that makes it far harder for security researchers to examine its payload after the fact. Earlier versions embedded the decryption key directly in their code, but the new variant fetches a decryption tool and performs a live key exchange with its command-and-control server before the malicious payload can be unlocked. Because a new key pair is generated each time the malware runs, even a captured key cannot be reused to decrypt a sample later, meaning analysis generally requires catching the malware while it is actively communicating with its server.

The malware's delivery method has also changed. Previous campaigns impersonated legitimate-looking apps such as Maccy, Scoppr, and Nancy Clipboard. The latest wave instead uses a fake website called Wavel, which pretends to offer a cryptocurrency wallet service. Victims who click a 'Download for macOS' button receive a disk image file containing a script that, when opened, quietly launches a hidden background process using Apple's built-in Script Editor and command line tools, ultimately installing the malware without obvious warning signs.

This approach shows how attackers are adapting macOS malware to specifically frustrate security teams, not just end users, by making offline analysis and detection signature creation more difficult.