Cybersecurity researchers at **Jamf Threat Labs** have uncovered a refined version of **PamStealer**, an information stealer targeting macOS systems. This latest iteration introduces several critical modifications designed to enhance its stealth and resilience against analysis.  ### Evolving Delivery and Decryption According to security researcher **Thijs Xhaflaire**, the core **JavaScript for Automation (JXA)** dropper mechanism remains, but the lure and delivery methods have been significantly altered. Previous **PamStealer** variants, observed in July and August 2026, relied on fake websites mimicking utilities like **Maccy**, **Scoppr**, and **Nancy Clipboard**. The new campaign, however, uses a bogus website, `wavel[.]app`, advertising a non-existent cryptocurrency wallet service named **Wavel**. Clicking the 'Download for macOS' button on this site delivers a disk image file, `Wavel.dmg`, containing a compiled **AppleScript** file. ### The JXA to Zsh Shift Upon opening the **AppleScript** file, **Apple's Script Editor** launches, triggering the execution of a **JXA** dropper. Crucially, the **JXA** source in this variant no longer performs direct payload decryption or manages the entire download and staging process, as it did in earlier versions. Instead, the **JXA** layer now acts solely as a carrier. It decodes a base64 string and pipes the result into `/bin/zsh -s`, which then executes the decoded bytes. The **JXA** process exits immediately, with the **zsh** dropper continuing silently in the background. ### Multi-Stage Infection Chain The decoded **zsh** script orchestrates a complex infection sequence: * Downloads and invokes a 'pkgunpack' decryption utility from `wavel.apple03cloudstore[.]com`. * Performs an **X25519** key exchange with the command-and-control (C2) server. * Decrypts and stages the main payload bundle. * Suppresses macOS notifications related to new background login items. * Establishes multiple persistence methods, including a **LaunchAgent**, a repair **zsh** script, and a shell hook appended to `~/.zshrc`. * Polls for and uploads the staging directory as a ZIP archive. ### Unprecedented Evasion Tactics One of the most significant advancements is the server-side decryption chain. The C2 server holds the private key required to complete the **X25519** key exchange, meaning the **Data Encryption Key (DEK)** cannot be recovered without its cooperation. Furthermore, a new ephemeral keypair is generated with each execution, preventing replay attacks to extract payload contents. This design makes static analysis of the encrypted payload virtually impossible without a live C2 session, significantly hindering researchers' ability to understand and counter the threat.  ### Enhanced Persistence and Stealer Capabilities The repair script is strategically copied to `~/Library/Application Support/System/.githooks/post-checkout` and `~/Library/Application Support/System/.githooks/pre-commit` folders. The **Git** configuration option `git config --global core.hooksPath` is then set to this directory, ensuring that any `git checkout` or `git commit` action on the compromised system will silently re-activate the repair script. The final stage is the stealer component, now written in **Swift** (a shift from **Rust** in previous versions). Its objectives remain comprehensive: * Capture system passwords via fake crash dialogs and **PAM**-based validation. * Enumerate and retrieve **keychain** items. * Steal credentials from a wide range of **Chromium**- and **Firefox**-based browsers, including **Google Chrome**, **Microsoft Edge**, **Mozilla Firefox**, **Brave**, **Vivaldi**, **Opera**, **Opera GX**, **Arc**, **Zen**, **Waterfox**, **LibreWolf**, **Yandex Browser**, and **Cốc Cốc**. * Fingerprint the system, gathering extensive metadata and the user's profile photo. * Collect user-centric files such as `.zsh_history`, `.zshrc`, `.bash_history`, and `.gitconfig`. * List running processes and installed applications. **Xhaflaire** notes that the inclusion of browsers like **Arc**, **Zen**, and other less common regional or privacy-focused browsers significantly extends the target list beyond what is typically seen in commodity macOS stealers. This evolution of **PamStealer** represents a substantial investment in sophisticated delivery infrastructure and evasion techniques, making it a formidable threat to macOS users and a challenge for security analysts.