As reported by The Hacker News, a new iteration of the PamStealer malware targeting macOS has been identified, employing a sophisticated server-side decryption chain to obscure its main payload, making static analysis significantly more challenging.The latest PamStealer variant, observed by Jamf Threat Labs, continues to use a JavaScript for Automation (JXA) dropper but has updated its lure and delivery mechanisms. Instead of embedding payload key material directly, it now fetches a dedicated decryption utility and performs a key exchange with a command-and-control (C2) server. This server-side cooperation is essential for unwrapping the payload, rendering it undecryptable without live C2 access.Victims are lured via a fake cryptocurrency wallet website, "wavel[.]app," leading to the download of a disk image containing a compiled AppleScript. This script triggers the JXA dropper, which then decodes a base64 string and passes it to "/bin/zsh". The zsh script downloads a "pkgunpack" decryption utility, executes an X25519 key exchange, and decrypts the payload. The malware also installs multiple persistence methods, including LaunchAgents and Git hooks, to ensure its continued operation. The stealer component, now written in Swift, targets a wide range of browsers and aims to capture system passwords, steal keychain items, and collect user-centric files. The inclusion of less common browsers like Arc and Zen expands its targeting scope.Source: The Hacker News
