# PamStealer macOS Infostealer Adds Live C2 with X25519 Key Exchange, Four-Method Persistence

> A new 'Wavel' variant of the PamStealer macOS infostealer, distributed via a fake cryptocurrency wallet site (wavel[.]app), decrypts its Swift-based second-stage payload live via an X25519 key exchange with wavel.apple03cloudstore[.]com, installs four redundant persistence mechanisms, and harvests Keychain data, credentials from 17 browsers, and the macOS login password via a fake crash dialog.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-10-07T20:49:51.296Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2674
- **ID:** TL-2026-2674
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)

## Description

PamStealer is a macOS credential-theft malware family, first documented publicly on 2026-07-02 by Jamf Threat Labs (researcher Thijs Xhaflaire), distinguished by validating captured system passwords locally through the macOS Pluggable Authentication Modules (PAM) API (pam_start/pam_authenticate/pam_end) before exfiltrating them. That original variant was distributed from a fake distribution domain, maccyapp[.]com, as a compiled AppleScript (Maccy.scpt) impersonating the legitimate Maccy clipboard-manager utility, dropping an arm64-only Rust Mach-O second stage that read browser and Keychain credential stores, captured clipboard contents via repeated pbpaste invocations, and persisted through both a modern SMAppService registration and a legacy fallback (a 34KB helper binary written to /private/tmp/System Settings that calls LSSharedFileListInsertItemURL against kLSSharedFileListSessionLoginItems), both pointed at a Finder.app bundle staged in ~/Library/Application Support/com.apple.finder.core/. It geofenced itself away from former-Soviet-bloc targets via three independent checks -- system timezone (Europe/Moscow, Europe/Minsk, Asia/Almaty), locale country code (RU, BY, KZ, AM, AZ, KG, MD, TJ, UZ, TM, GE), and active keyboard layout -- and additionally required Apple Silicon hardware, failing silently on Intel hosts. It exfiltrated to avenger-sync[.]live/api/sync over Cloudflare-fronted, ChaCha20-Poly1305-encrypted POST requests, alongside references to Ethereum RPC endpoints (eth.drpc.org, ethereum-rpc.publicnode[.]com) consistent with cryptocurrency-wallet targeting.

In September 2026, Jamf Threat Labs documented a substantially rearchitected variant, internally themed 'Wavel', distributed via a fake multichain-wallet website (wavel[.]app) whose 'Download for macOS' button serves Wavel.dmg from y32me8[.]com. The DMG contains an unsigned, extension-hidden compiled AppleScript -- identifiable by its JsOsaDAS1.001.00 compiled-JXA magic-byte header -- that Finder displays as a generic document; opening it in Script Editor triggers a JXA (JavaScript for Automation) layer that decodes a 24,868-character base64 blob and pipes it directly into /bin/zsh -s, detaching execution from Script Editor via a backgrounded daemon_function & ; exit 0.

The zsh dropper downloads a FAT Mach-O utility, pkgunpack (from wavel.apple03cloudstore[.]com/pkgunpack), that performs an X25519 (ECIES) key exchange with the same domain's /v1/loader/dek endpoint: a fresh ephemeral keypair is generated on every execution, the resulting shared secret is hashed with SHA-256 under the domain separator 'sn-dek-wrap-v1' into a key-encryption key, and the server-returned wrapped DEK (magic SNWK1) is unwrapped via AES-256-GCM to decrypt the SNP1-tagged, tar.gz-packaged second-stage payload fetched from a per-victim CoreUpdate.pkg.enc URL. Because decryption requires live cooperation from the C2 server and each session's DEK cannot be replayed, static/offline recovery of the payload is not possible from a captured sample alone; a local .sysnotif-backup.tgz tarball lets the malware re-stage itself without a fresh C2 round-trip if only the installed bundle is removed.

The decrypted second stage is a universal Swift Mach-O binary (internal name r8afup9un0, project name MacClient) installed as ~/Library/Application Support/System/Finder.app (renamed from Wavel.app to masquerade as a system component) and registered via `launchctl bootstrap gui/<UID>` as a LaunchAgent labeled com.apple.finder.agent that re-executes every 15 seconds and restarts on crash. Beyond the LaunchAgent, the malware installs three additional, redundant persistence layers: a .repair-run script (marked # sysnotif-repair) that restores the bundle and LaunchAgent registration if either is removed; a hook appended to ~/.zshrc that silently triggers the repair script on every interactive shell session without needing C2 contact; and global Git hooks (post-checkout, pre-commit) installed under ~/Library/Application Support/System/.githooks/ via git config --global core.hooksPath, which re-trigger persistence on any git checkout or git commit. The malware suppresses macOS's background-item and notification alerting by SIGSTOP-pausing BackgroundTaskManagementAgent, BTMNotificationAgent, and NotificationCenter before it registers itself.

For credential theft, the malware retains the family's namesake PAM-based password validation (_pam_verify_login) behind a two-stage UI lure -- a spoofed 'macOS wants to make changes' authorization prompt followed by a fake 'damaged and can't be opened' crash dialog, with the displayed app name controlled by the SONOMA_DISPLAY_NAME environment variable -- validating the entered password against the local 'login' PAM service before capture. It unlocks and copies the login Keychain (security unlock-keychain, set-generic-partition-list, direct copy of login.keychain-db) and, via 13 per-browser helper apps (Helper_<Browser>Storage.app containing a KcHelper executable, coordinated through KC_PASS/KC_STAGING/KC_SERVICE/KC_ACCOUNT environment variables) after killing browser helper processes, performs read-only SQLite backups (sqlite3_backup_init/step/finish) of credential and cookie databases across 17 browser families including Chrome, Edge, Firefox, Brave, Vivaldi, Opera/Opera GX, Arc, Zen, Waterfox, LibreWolf, Yandex, and Coc Coc. It additionally collects extensive system fingerprinting (hardware UUID/serial, OS version, SIP status, GPU/display data via 21 separate system_profiler invocations), shell/config history (.zsh_history, .bash_history, .zshrc, .gitconfig), running processes and installed applications, and -- unusually for a stealer -- the user's Open Directory profile photo via `dscl . -read /Users/<user> JPEGPhoto`. Collected data is organized into staging subdirectories (Password, Username, Mode, Keychains/, Browsers/, Extensions/, Wallets/, UserFiles/), archived with ditto -c -k --sequesterRsrc (preserving resource forks/xattrs), staged and stability-checked in a temp lock directory, validated with zip -T, and exfiltrated via a single PUT request carrying a stable, build-specific X-Upload-Token header to a per-victim asset URL on the C2 domain.

No CVE applies; this is a social-engineering-delivered malware campaign rather than a software vulnerability. Jamf published its Wavel analysis on 2026-09-22; GBHackers independently corroborated the findings on 2026-09-23; The Hacker News and Mallory.ai brought it to a broader audience on 2026-09-25, at which point the wavel[.]app lure and its infrastructure were reported as still actively live. A related researcher (L0psec) had separately posted overlapping observations on social media earlier in September, indicating the family is under continued active development.

## MITRE ATT&CK

- T1583.001 Domains
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1059.004 Unix Shell
- T1027 Obfuscated Files or Information
- T1553.001 Gatekeeper Bypass
- T1543.001 Launch Agent
- T1546.004 Unix Shell Configuration Modification
- T1547.015 Login Items
- T1564.001 Hidden Files and Directories
- T1685 Disable or Modify Tools
- T1056.002 GUI Input Capture
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1573.002 Asymmetric Cryptography
- T1071.001 Web Protocols
- T1059.002 Command and Scripting Interpreter: AppleScript
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1552.003 Unsecured Credentials: Shell History
- T1057 Process Discovery
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [PamStealer macOS Malware Adds Live C2 Payload Decryption and New Persistence Tricks](https://thehackernews.com/2026/09/pamstealer-macos-malware-adds-live-c2.html)
- [New PamStealer variant targets macOS via fake crypto wallet](https://www.jamf.com/blog/pamstealer-wavel-macos-infostealer/)
- [PamStealer: macOS Malware Posing as Clipboard Manager App](https://www.jamf.com/blog/pamstealer-macos-infostealer-applescript-rust/)
- [Fake Crypto Wallet App Delivers PamStealer Malware That Hijacks Mac Credentials](https://gbhackers.com/fake-crypto-wallet-app/)
- [New Mac infostealer confirms stolen passwords before stealing data](https://appleinsider.com/articles/26/07/02/new-mac-infostealer-confirms-stolen-passwords-before-stealing-data)
- [PamStealer is a Rust-based macOS infostealer that validates credentials through PAM](https://appleworld.today/2026/07/pamstealer-is-a-rust-based-macos-infostealer-that-validates-credentials-through-pam/)
- [PamStealer macOS Infostealer Uses Rust Payload to Validate and Steal Passwords](https://cyberpress.org/pamstealer-macos-infostealer/)
- [Fake Crypto Wallet Site Delivers PamStealer to Steal macOS Credentials](https://mallory.ai/stories/01a0ce6b-670b-7582-af8b-f133dd5538f6)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2674