PamStealer Wavel: The C2 Becomes the Cryptographic Key, Static Analysis Hits a Wall

On September 22, 2026, Jamf Threat Labs documented a new variant of the macOS infostealer family PamStealer, dubbed Wavel. The evolutionary leap lies not in the catalog of stolen data, but in the architecture: the malware turns its command-and-control server from a mere exfiltration endpoint into an indispensable cryptographic prerequisite for execution. Without an active server response, the secondary payload stays locked.

This structure renders automated sandboxes and traditional static analysis ineffective—tools on which much of enterprise macOS defense relies. The risk extends beyond the single endpoint: one of four persistence mechanisms nests in global Git hooks, with potential for cascading contamination in software supply chains.

The Server-Side Chain That Obscures the Payload

The initial dropper arrives as a compiled AppleScript file (.scpt). Upon execution, it decodes a 24,868-character base64 string and passes it to /bin/zsh -s: the JXA process terminates immediately while the shell script continues in background. This process separation complicates forensic tracking.

The script downloads the pkgunpack utility from wavel.apple03cloudstore[.]com, a dual-architecture Mach-O FAT binary (arm64/x86_64). Thijs Xhaflaire of Jamf Threat Labs documented that pkgunpack uses X25519 for key exchange, via a statically linked curve25519_donna, and AES-256-GCM with SHA-256 for symmetric decryption. For each execution, the malware generates an ephemeral key pair; it sends the public key to the C2 server, which responds with a wrapped DEK (Data Encryption Key).

"Without the server's cooperation, the payload cannot be recovered statically"
— Thijs Xhaflaire, Jamf Threat Labs

The wrapped DEK format begins with the magic bytes "SNWK1", followed by the AES-GCM IV, the encrypted DEK, and the authentication tag. The server's private key completes the X25519 exchange: without it, the DEK is not derivable even in possession of the full sample. The decrypted payload is a tar.gz archive that expands into "Wavel.app", then renamed to "Finder.app" with an installation path that masquerades as a system component.

Four Redundant Persistence Rings With Self-Repair

Persistence operates across four redundant levels. The first is a LaunchAgent named com.apple.finder.agent executing every 15 seconds. The second is a repair script at ~/Library/Application Support/System/.repair-run. The third is a hook in ~/.zshrc marked with # sysnotif-repair. The fourth is the injection of global Git hooks into ~/Library/Application Support/System/.githooks/, specific to post-checkout and pre-commit operations.

The repair script activates not only at reboot, but on every git checkout or git commit in any repository on the compromised system. This mechanism requires no network contact for restoration, making persistence resilient even without C2 connectivity. Additionally, the dropper suppresses the macOS notification for new background login items by pausing system processes before the launchctl bootstrap.

The abuse of global Git hooks is particularly insidious for developers: version-control operations, daily rituals of the software workflow, unwittingly become reactivation vectors. The source does not specify whether this technique has been previously observed in the macOS malware landscape.

The Shift From Rust to Swift and the Stealer's Reach

The data-theft component is rewritten in Swift, marking a break from previous variants implemented in Rust. It is not documented whether the migration is definitive or if both versions coexist in parallel campaigns.

Collection capabilities include: password capture via a fake crash dialog with PAM validation; credential theft from Chromium- and Firefox-based browsers, extending to less common clients such as Arc, Zen, and regional or privacy-focused browsers; system fingerprinting; collection of .zsh_history, .zshrc, .bash_history, .gitconfig files; enumeration of running processes and installed applications. Xhaflaire noted that "the inclusion of Arc, Zen, and regional and privacy-focused browsers extends the target list beyond what is typical in commodity macOS infostealers."

What to Do Now

• Inspect LaunchAgents in ~/Library/LaunchAgents and com.apple.finder.agent entries that mimic system names but use non-standard paths: the real binary resides in hidden folders under Application Support
• Check for .githooks directories in ~/Library/Application Support/System/ and references to sysnotif-repair in shell configuration files: these indicators are consistent with the persistence chain documented by Jamf
• Analyze traffic to domains matching the *.apple03cloudstore[.]com pattern and the presence of Mach-O binaries with genkey and decrypt commands in strings: these are signals of preparation for the key-exchange phase
• Review execution policies for compiled AppleScripts (.scpt) in non-enterprise contexts: the initial dropper exploits this format to evade superficial checks

The Boundary With MacSync: Technical Convergence, Attribution Uncertainty

Kaspersky, via its Securelist platform, analyzed a family named MacSync with technically overlapping mechanisms: the same pkgunpack utility with genkey/decrypt commands, the same ECDH Curve25519 algorithm, the same DEK wrapping structure with SHA-256 and domain separator, persistence via .zshrc, data upload in PUT chunks of approximately 90 megabytes. It is not, however, confirmed whether PamStealer and MacSync are the same family under different names, or distinct families sharing tooling and infrastructure. The relationship is not explicitly clarified by available sources.

This independent convergence raises questions about the modularity of the development ecosystem behind these threats. If the pkgunpack tooling is reusable, the barrier to entry for new operators lowers, but the cryptographic sophistication indicates deliberate investment rather than opportunistic assembly.

Why the Defense Paradigm Shifts

PamStealer Wavel's evolution signals a rethinking of offensive logic on macOS. Infostealers for this platform were traditionally considered less sophisticated than their Windows counterparts; the server-side decryption chain with ephemeral key exchange levels that perception. The forensic analyst can no longer isolate the sample and wait for it to reveal its behavior: the C2 is an integral part of the execution logic, not merely a recipient of stolen data.

Persistence via global Git hooks adds a collective risk dimension to individual damage. A compromised endpoint in a development team is not just a workstation to sanitize, but a potential propagation node toward shared repositories. The undeclared datum is the extent of contamination: it is not documented whether this technique has already generated secondary infections in enterprise contexts.

Sources

• https://thehackernews.com/2026/09/pamstealer-macos-malware-adds-live-c2.html
• https://securelist.com/macsync-new-version/121383/
• https://www.guardianmssp.com/2026/09/25/pamstealer-macos-malware-adds-live-c2-payload-decryption-and-multi-layer-persistence/
• https://www.jamf.com/blog/pamstealer-wavel-macos-infostealer/
• https://news.cybertechworld.co.in/index.php/2026/09/25/pamstealer-macos-malware-adds-live-c2-payload-decryption-and-multi-layer-persistence/
• https://thehackernews.com/
• https://thehackernews.com/p/upcoming-hacker-news-webinars.html
• https://thehackernews.com/search/label/Threat%20Intelligence
• https://thehackernews.com/search/label/Vulnerability
• https://thehackernews.com/search/label/Cyber%20Attack

Information verified against cited sources and current as of publication.

Sources