Reported by 4 outlets
New PamStealer macOS variant adds live C2 payload decryption and multi-layer persistence
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.02 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Jamf Threat Labs (researcher Thijs Xhaflaire) documented a new Wavel-variant PamStealer targeting macOS, published on September 22, 2026. The malware uses a compiled JXA dropper paired with a zsh carrier and a pkgunpack ECIES decryption utility to retrieve payloads live from command-and-control infrastructure at wavel.apple03cloudstore[.]com via X25519 key exchange. The Swift-based second stage, identified as MacClient or r8afup9un0, executes after decryption. Persistence spans four layers: a LaunchAgent, a repair script, a ~/.zshrc hook, and git hooks. The disclosure includes full indicator-of-compromise lists with SHA256 hashes and C2 endpoints.
Mac administrators should audit endpoints for LaunchAgent entries, zshrc modifications, and unexpected git hooks. The multi-layer persistence and live payload decryption make removal more complex than standard macOS malware; a full endpoint reimaging may be warranted for confirmed infections. Distribution rides on fake Wavel-branded applications, so block the documented C2 domain, apply endpoint detection rules for the published hashes, and treat unexpected Wavel installers as suspicious.
Timeline
-
original reporting
🤖 New PamStealer macOS variant decrypts its payload live from C2 and adds multi-layer persistence. JXA dropper updated with new lure and del
thehackernews.com · 18d ago · September 25th, 2026
🤖 New PamStealer macOS variant decrypts its payload live from C2 and adds multi-layer persistence. JXA dropper updated with new lure and del
via Mastodon https://thehackernews.com/2026/09/pamstealer-macos-malware-adds-live-c2.html
-
update from jamf.com
PamStealer adapts again: a move to Swift with a server-side decryption chain
jamf.com · 22d ago · September 22nd, 2026
Jamf Threat Labs (researcher Thijs Xhaflaire) published the original disclosure of this Wavel-variant PamStealer on September 22, 2026, three days before The Hacker News coverage. The report documents the compiled JXA dropper, the zsh carrier, the pkgunpack ECIES decryption utility, the live X25519 key exchange with wavel.apple03cloudstore[.]com, the Swift-based second stage (MacClient / r8afup9un0), and the four-layer persistence (LaunchAgent, repair script, ~/.zshrc hook, git hooks). It also provides full IoC lists including SHA256 hashes and C2 endpoints.
-
update from cyberworldops.eu
Jamf Threat Labs found a PamStealer macOS variant that withholds its main payload until live X25519 key exchange and server-assisted decrypt
cyberworldops.eu · 18d ago · September 26th, 2026
Jamf Threat Labs found a PamStealer macOS variant that withholds its main payload until live X25519 key exchange and server-assisted decrypt
via Mastodon https://cyberworldops.eu/en/pamstealer-makes-macos-payload-recovery-depend-on-its-command-server
-
update from thehackernews.com
🤖 PamStealer macOS stealer evolved: the payload is now unwrapped through a server-side key exchange, so it can't be decrypted statically wit
thehackernews.com · 18d ago · September 26th, 2026
🤖 PamStealer macOS stealer evolved: the payload is now unwrapped through a server-side key exchange, so it can't be decrypted statically wit
via Mastodon https://thehackernews.com/2026/09/pamstealer-macos-malware-adds-live-c2.html
-
mentioned by thehackernews.com
PamStealer Adds Live C2 Decryption and Stronger macOS Persistence https:// thehackernews.com/2026/09/pamste aler-macos-malware-adds-live-c2.
thehackernews.com · 17d ago · September 26th, 2026
-
update from securityonline.info
A new PamStealer macOS infostealer spreads via fake Wavel apps. Learn how the PamStealer macOS infostealer steals system passwords and brows
securityonline.info · 15d ago · September 28th, 2026
A new PamStealer macOS infostealer spreads via fake Wavel apps. Learn how the PamStealer macOS infostealer steals system passwords and brows
via Mastodon https://securityonline.info/pamstealer-macos-infostealer/?utm_source=mastodon&utm_medium=jetpack_social