PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence
AI-summarised brief · reviewed before publication
Cybersecurity researchers identified a new PamStealer macOS variant that encrypts its payload with a server‑side decryption chain, making static analysis impossible without live C2 access. The malware still uses a JavaScript for Automation (JXA) dropper but now fetches a dedicated decryption utility and performs a key exchange before unwrapping the payload. It lures victims via a fake “Wavel” cryptocurrency wallet site, delivering a disk image that runs a Script Editor script, which pipes a base64‑encoded zsh payload into the shell. The zsh script generates a fresh key pair, retrieves the Data Encryption Key from the server, and installs a repair script in Git hooks to trigger on checkout or commit. The final stealer component is rewritten in Swift, expanding target browsers and tightening delivery infrastructure.
💡 Why It Matters
- · By tying payload decryption to an active C2 session, attackers can evade static analysis and force defenders to monitor live traffic, increasing the difficulty of early detection.
- · The use of Git hooks for persistence exploits a common developer workflow, broadening the attack surface within enterprise codebases.
