Executive Summary
A new variant of the PamStealer macOS infostealer has been identified, demonstrating significant technical evolution. The campaign uses a fraudulent cryptocurrency wallet website, wavel[.]app, to distribute disk images containing compiled JXA droppers. This version introduces a sophisticated delivery chain that prevents static analysis by requiring a live key exchange with the Command and Control (C2) server to decrypt the main payload.
The technical shift includes a transition from a Rust-based payload to a Swift-based one, though it retains its namesake technique of using Pluggable Authentication Modules (PAM) for password validation. The malware features aggressive persistence mechanisms, including LaunchAgents, shell hooks in .zshrc, and Global Git hooks, making remediation and removal more difficult than standard commodity stealers.
This threat is particularly concerning for organizations with macOS fleets as it targets sensitive credentials across seventeen different browsers, exfiltrates keychain data, and even harvests user profile photos. The use of server-side decryption (SNP1/SNWK1 envelopes) reflects a deliberate investment in anti-analysis tradecraft, ensuring the payload remains inert unless the C2 infrastructure is active.