CTI · reviewed · 2026-09-27

New PamStealer macOS variant adds live C2 payload decryption and multi-layer persistence

Full story & timeline

Actors

—

Malware / tools

PamStealer

Campaigns

PamStealer Wavel variant

CVEs

—

Victim sectors

—

Geography

—

MITRE ATT&CK

T1059 Command and Scripting Interpreter Execution
T1037 Boot or Logon Initialization Scripts Persistence
T1159 Launch Agent Persistence
T1573 Encrypted Channel Command and Control
T1105 Ingress Tool Transfer Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: PamStealer Wavel Variant C2 Key Exchange - wavel.apple03cloudstore.com
id: a1630d8d-4f7a-404f-b6bb-5823b719906c
status: experimental
description: Detects network connections to wavel.apple03cloudstore[.]com, the X25519 key-exchange command server of the PamStealer Wavel-variant macOS infostealer whose payload is decrypted live from C2 so it cannot be recovered statically (Jamf Threat Labs disclosure, September 22, 2026).
references:
  - https://thehackernews.com/2026/09/pamstealer-macos-malware-adds-live-c2.html
  - https://www.jamf.com/blog/pamstealer-wavel-macos-infostealer/
  - https://cyberworldops.eu/en/pamstealer-makes-macos-payload-recovery-depend-on-its-command-server
author: Tia N. List
date: 2026-09-27
tags:
  - attack.t1573
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection_c2:
    DestinationHostname|endswith: 'wavel.apple03cloudstore.com'
  condition: selection_c2
falsepositives:
  - None expected for the registered attacker domain; only security tooling that resolves the indicator would match
level: high

YARA-X raw

rule PamStealer_Wavel_MacClient {
    meta:
        author = "Tia N. List"
        date = "2026-09-27"
        status = "experimental"
        description = "PamStealer Wavel-variant macOS infostealer (Jamf Threat Labs, September 22, 2026): live X25519 key exchange with the C2 host wavel.apple03cloudstore.com, the pkgunpack ECIES decryption utility, and the Swift second stage identified as MacClient / r8afup9un0. Derived from case analysis - NOT validated against a live sample."
        reference = "https://www.jamf.com/blog/pamstealer-wavel-macos-infostealer/"
        falsepositives = "Any file embedding the C2 domain (IOC lists, sandbox reports, blocklists) can match on $c2 alone - corroborate with network and persistence telemetry; the second-stage branch requires r8afup9un0 together with MacClient or pkgunpack"
    strings:
        $c2 = "wavel.apple03cloudstore.com" ascii nocase
        $stage = "r8afup9un0" ascii nocase
        $client = "MacClient" ascii nocase
        $decrypt = "pkgunpack" ascii nocase
    condition:
        $c2 or ($stage and ($client or $decrypt))
}

References

Source on GitHub