PamStealer: The macOS Malware That Only Decrypts Its Payload With a Live C2 Server

On September 25, 2026, Jamf Threat Labs researchers published their analysis of a new variant of the macOS malware PamStealer that introduces a structural shift in the Apple threat landscape: final payload decryption is contingent on the availability of the command-and-control server. Without a live connection to the C2, the second stage remains unrecoverable to static analysis. This is not a marginal detail; it changes the equation between defenders and attackers, rendering traditional sandboxes that execute samples in isolation useless.

The Mechanism That Kills Offline Analysis

The core technical evolution centers on the pkgunpack utility, downloaded from the domain wavel.apple03cloudstore[.]com. On every execution, this utility generates an ephemeral Curve25519 key pair and initiates an exchange with the server. The server holds the complementary private key: only by completing the ECDH can it generate the shared secret needed to decrypt the data encryption key (DEK). The payload remains encrypted in the absence of this cooperation.

Thijs Xhaflaire of Jamf Threat Labs summarized the operational advantage for attackers: Where earlier variants embedded their payload key material directly in the JXA source, it now fetches a purpose-built decryption utility and completes a key exchange with the server before the payload can be unwrapped. The consequence is that every execution generates a new ephemeral key pair, preventing replay of a DEK potentially captured in a previous session.

The architecture represents a leap beyond traditional obfuscation techniques. It is not about making reverse engineering more laborious; it is about making it impossible without the server. Automated sandboxes that execute samples in isolation never receive the DEK: the second stage never materializes, behavioral signatures do not trigger, and the infection chain remains incomplete.

"Without the server's cooperation, the payload cannot be recovered statically"

The Four Rings of Persistence: When Reinfection Is the Default

The new variant installs four overlapping, mutually redundant persistence methods. The first is a classic LaunchAgent. The second is a zsh repair script that reinstalls components if they go missing. The third is a shell hook inserted into the ~/.zshrc file. The fourth, and the most insidious for development environments, exploits Git hooks.

The repair script is copied into the post-checkout and pre-commit folders inside ~/Library/Application Support/System/.githooks/, with the global configuration git config --global core.hooksPath redirected to that path. Every git checkout or commit in any local repository triggers the malware. The abuse of Git hooks turns routine developer operations into reinfection triggers, with specific impact on environments managing source code, private repositories, and CI/CD pipelines.

Xhaflaire noted that the inclusion of browsers such as Arc, Zen, and regional products like Yandex Browser and Cốc Cốc extends the target noticeably beyond what is typical in commodity macOS stealers. This targeting care suggests attention to technically aware users who may have privileged access to critical infrastructure.

The New Swift Stealer and Credential Harvesting

The final stealer component has been rewritten in Swift, abandoning the predecessor's Rust implementation. The language shift may indicate an infrastructure refactor or the adoption of a different toolchain by the development group. The malware captures the system password by serving a fake crash window and validating input via a PAM-based approach.

From Chromium- and Firefox-based browsers, it extracts credentials from Chrome, Edge, Firefox, Brave, Vivaldi, Opera, Opera GX, Arc, Zen, Waterfox, LibreWolf, Yandex Browser, and Cốc Cốc. It also collects user-centric files: .zsh_history, .zshrc, .bash_history, and .gitconfig. The combination of browser credentials, shell history, and Git configuration enables detailed reconstruction of victim activity, with exposure of access tokens for repositories and cloud environments.

The current entry vector runs through a fictitious site, wavel[.]app, advertising a non-existent cryptocurrency wallet service called Wavel. Clicking "Download for macOS" retrieves a disk image Wavel.dmg containing a compiled AppleScript file. The entire JXA layer is reduced to a pure carrier: when Script Editor executes the file, it decodes a base64 string and pipes it to /bin/zsh -s, which in turn fetches pkgunpack and initiates the decryption chain.

What to Do Now

• Check for the presence of the directory ~/Library/Application Support/System/.githooks/ and anomalous global Git configurations pointing to non-standard paths, with particular attention to core.hooksPath.
• Inspect LaunchAgents in ~/Library/LaunchAgents for entries not attributable to legitimate software, given the overlap of this mechanism with the other three in the current variant.
• Analyze DNS traffic and outbound connections to domains resembling wavel.apple03cloudstore[.]com, considering that the encrypted payload is downloaded only after the key exchange and may not trigger static signatures.
• Review execution policies for DMG files and compiled AppleScripts on developer systems, given the identification of these formats as carriers in the Wavel campaign.

The Questions the Dossier Does Not Answer

It is unconfirmed whether PamStealer and MacSync — a related malware family documented by Kaspersky that shares techniques such as pkgunpack and ECDH Curve25519 — represent the same project or two distinct operations with common contractors or toolchains. Kaspersky described MacSync in the context of DMG delivery and a decryption utility using the same cryptographic primitives, but did not analyze PamStealer directly.

Also unspecified are the number of confirmed victims, the geography of infections, and the possible presence of a backdoor component beyond the stealer. The brief does not document whether GitHub Security Lab or other vendors have released dedicated detection signatures, nor whether the Wavel campaign represents an isolated operation or a broader malware-as-a-service deployment.

The data that emerges clearly is the deliberate investment in delivery infrastructure. The transformation of JXA from a key container to a neutral carrier, the introduction of C2-bound ECDH key exchange, and the quadrupling of persistence methods indicate an actively maintained project, with iterations responding to friction points encountered in previous variants. For organizations relying on sandboxes and static analysis for their first line of defense, this specific sample marks a concrete limit: without C2 server emulation, the real payload does not show itself.

Sources

• https://securelist.com/macsync-new-version/121383/
• https://github.com/SecOpsNews/news/issues/74415
• https://www.guardianmssp.com/2026/09/25/pamstealer-macos-malware-adds-live-c2-payload-decryption-and-multi-layer-persistence/
• https://www.infosectoday.io/pamstealer-macos-malware-adds-live-c2-payload-decryption-and-multi-layer-persistence
• https://support.github.com/
• https://github.com/SecOpsNews/news/issues
• https://github.com/SecOpsNews/news/pulls
• https://github.com/SecOpsNews/news/security
• https://thehackernews.com/2026/09/pamstealer-macos-malware-adds-live-c2.html