A new PamStealer variant is targeting macOS users through a fake cryptocurrency wallet installer. In research published on September 22, Jamf Threat Labs said the malware steals passwords and browser data while using a server-controlled decryption process that makes its payload harder to analyze.
The attack begins at wavel[.]app, a site impersonating a multichain crypto wallet. Its macOS download button delivers a disk image containing a compiled .scpt file.
Because Finder normally hides file extensions, the file can appear to be an ordinary document. If a user opens it in Script Editor and follows the displayed instructions, embedded JavaScript for Automation runs a hidden zsh dropper.
The dropper downloads a tool called pkgunpack and an encrypted payload from wavel.apple03cloudstore[.]com. Unlike earlier PamStealer variants, it does not carry the payload’s decryption key.
Instead, pkgunpack creates a fresh key pair and contacts the server for the material needed to unlock the payload. Without a response from that server, researchers cannot recover the second stage from the encrypted file alone.
PamStealer Steals Mac Crypto Credentials
After decryption, the dropper installs the malicious app as Finder.app under the user’s Library folder. It removes the downloaded tool’s quarantine attribute and applies an ad-hoc signature before execution.
It also interferes with macOS background-item notification processes while registering a LaunchAgent named com.apple.finder.agent.
The second stage is written in Swift, replacing the Rust implementation seen in the first PamStealer variant. It displays a macOS-style password prompt, then checks the entered password through Pluggable Authentication Modules, or PAM.
A second dialog imitates a damaged-app error, helping disguise the activity. PamStealer accesses Keychain items and copies the login Keychain database.
It also targets credential databases across 17 browser variants, including Chrome, Firefox, Brave, Edge, Arc and Zen.
The malware package contains browser-specific helper apps that can present themselves as the corresponding browser when accessing protected Keychain entries.
Jamf’s analysis also found collection of system details, shell history, and the user’s account photo. In its test, the staging folder included directories for browsers, extensions and wallets.
The malware packed the collected data into a ZIP archive, which the still-running dropper uploaded to its server. Jamf observed the archive being assembled and uploaded in a sandbox.
Removal may be difficult because the malware uses several repair methods. Alongside its LaunchAgent, it adds a shell startup hook and global Git hooks. A local backup archive can restore the malicious app even without a network connection, Jamf said.
Mac users should avoid wallet installers from unverified sites and treat requests to open scripts in Script Editor as suspicious.
Defenders investigating possible infections can check for the com.apple.finder.agent LaunchAgent, the hidden Finder.app installation, and connections to the domains identified in Jamf’s report.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
