PamStealer is a macOS credential-theft malware family, first documented publicly on 2026-07-02 by Jamf Threat Labs (researcher Thijs Xhaflaire), distinguished by validating captured system passwords locally through the macOS Pluggable Authentication Modules (PAM) API (pam_start/pam_authenticate/pam_end) before exfiltrating them. That original variant was distributed from a fake distribution domain, maccyapp[.]com, as a compiled AppleScript (Maccy.scpt) impersonating the legitimate Maccy clipboard-manager utility, dropping an arm64-only Rust Mach-O second stage that read browser and Keychain credential stores, captured clipboard contents via repeated pbpaste invocations, and persisted through both a modern SMAppService registration and a legacy fallback (a 34KB helper binary written to /private/tmp/System Settings that calls LSSharedFileListInsertItemURL against kLSSharedFileListSessionLoginItems), both pointed at a Finder.app bundle staged in ~/Library/Application Support/com.apple.finder.core/. It geofenced itself away from former-Soviet-bloc targets via three independent checks -- system timezone (Europe/Moscow, Europe/Minsk, Asia/Almaty), locale country code (RU, BY, KZ, AM, AZ, KG, MD, TJ, UZ, TM, GE), and active keyboard layout -- and additionally required Apple Silicon hardware, failing silently on Intel hosts. It exfiltrated to avenger-sync[.]live/api/sync over Cloudflare-fronted, ChaCha20-Poly1305-encrypted POST requests, alongside references to Ethereum RPC endpoints (eth.drpc.org, ethereum-rpc.publicnode[.]com) consistent with cryptocurrency-wallet targeting.

In September 2026, Jamf Threat Labs documented a substantially rearchitected variant, internally themed 'Wavel', distributed via a fake multichain-wallet website (wavel[.]app) whose 'Download for macOS' button serves Wavel.dmg from y32me8[.]com. The DMG contains an unsigned, extension-hidden compiled AppleScript -- identifiable by its JsOsaDAS1.001.00 compiled-JXA magic-byte header -- that Finder displays as a generic document; opening it in Script Editor triggers a JXA (JavaScript for Automation) layer that decodes a 24,868-character base64 blob and pipes it directly into /bin/zsh -s, detaching execution from Script Editor via a backgrounded daemon_function & ; exit 0.

The zsh dropper downloads a FAT Mach-O utility, pkgunpack (from wavel.apple03cloudstore[.]com/pkgunpack), that performs an X25519 (ECIES) key exchange with the same domain's /v1/loader/dek endpoint: a fresh ephemeral keypair is generated on every execution, the resulting shared secret is hashed with SHA-256 under the domain separator 'sn-dek-wrap-v1' into a key-encryption key, and the server-returned wrapped DEK (magic SNWK1) is unwrapped via AES-256-GCM to decrypt the SNP1-tagged, tar.gz-packaged second-stage payload fetched from a per-victim CoreUpdate.pkg.enc URL. Because decryption requires live cooperation from the C2 server and each session's DEK cannot be replayed, static/offline recovery of the payload is not possible from a captured sample alone; a local .sysnotif-backup.tgz tarball lets the malware re-stage itself without a fresh C2 round-trip if only the installed bundle is removed.

The decrypted second stage is a universal Swift Mach-O binary (internal name r8afup9un0, project name MacClient) installed as ~/Library/Application Support/System/Finder.app (renamed from Wavel.app to masquerade as a system component) and registered via `launchctl bootstrap gui/<UID>` as a LaunchAgent labeled com.apple.finder.agent that re-executes every 15 seconds and restarts on crash. Beyond the LaunchAgent, the malware installs three additional, redundant persistence layers: a .repair-run script (marked # sysnotif-repair) that restores the bundle and LaunchAgent registration if either is removed; a hook appended to ~/.zshrc that silently triggers the repair script on every interactive shell session without needing C2 contact; and global Git hooks (post-checkout, pre-commit) installed under ~/Library/Application Support/System/.githooks/ via git config --global core.hooksPath, which re-trigger persistence on any git checkout or git commit. The malware suppresses macOS's background-item and notification alerting by SIGSTOP-pausing BackgroundTaskManagementAgent, BTMNotificationAgent, and NotificationCenter before it registers itself.

For credential theft, the malware retains the family's namesake PAM-based password validation (_pam_verify_login) behind a two-stage UI lure -- a spoofed 'macOS wants to make changes' authorization prompt followed by a fake 'damaged and can't be opened' crash dialog, with the displayed app name controlled by the SONOMA_DISPLAY_NAME environment variable -- validating the entered password against the local 'login' PAM service before capture. It unlocks and copies the login Keychain (security unlock-keychain, set-generic-partition-list, direct copy of login.keychain-db) and, via 13 per-browser helper apps (Helper_<Browser>Storage.app containing a KcHelper executable, coordinated through KC_PASS/KC_STAGING/KC_SERVICE/KC_ACCOUNT environment variables) after killing browser helper processes, performs read-only SQLite backups (sqlite3_backup_init/step/finish) of credential and cookie databases across 17 browser families including Chrome, Edge, Firefox, Brave, Vivaldi, Opera/Opera GX, Arc, Zen, Waterfox, LibreWolf, Yandex, and Coc Coc. It additionally collects extensive system fingerprinting (hardware UUID/serial, OS version, SIP status, GPU/display data via 21 separate system_profiler invocations), shell/config history (.zsh_history, .bash_history, .zshrc, .gitconfig), running processes and installed applications, and -- unusually for a stealer -- the user's Open Directory profile photo via `dscl . -read /Users/<user> JPEGPhoto`. Collected data is organized into staging subdirectories (Password, Username, Mode, Keychains/, Browsers/, Extensions/, Wallets/, UserFiles/), archived with ditto -c -k --sequesterRsrc (preserving resource forks/xattrs), staged and stability-checked in a temp lock directory, validated with zip -T, and exfiltrated via a single PUT request carrying a stable, build-specific X-Upload-Token header to a per-victim asset URL on the C2 domain.

No CVE applies; this is a social-engineering-delivered malware campaign rather than a software vulnerability. Jamf published its Wavel analysis on 2026-09-22; GBHackers independently corroborated the findings on 2026-09-23; The Hacker News and Mallory.ai brought it to a broader audience on 2026-09-25, at which point the wavel[.]app lure and its infrastructure were reported as still actively live. A related researcher (L0psec) had separately posted overlapping observations on social media earlier in September, indicating the family is under continued active development.