PamStealer Malware Evolution: Live C2 Decryption Challenges macOS Security
In September 2026, cybersecurity researchers discovered an evolved version of PamStealer macOS malware that implements sophisticated live command-and-control payload decryption and multi-layer persistence mechanisms. The new variant distributes through a fake cryptocurrency wallet website called "Wavel" and uses server-side X25519 key exchange to prevent static analysis of encrypted payloads. The malware establishes four redundant persistence methods including LaunchAgent installations, repair scripts, and Git hook injections, while stealing credentials from over a dozen browsers, keychain items, and system passwords through fake crash dialogs. This incident highlights the growing sophistication of macOS-targeted information stealers as threat actors invest heavily in anti-analysis techniques and delivery infrastructure, making traditional signature-based detection and static malware analysis significantly more challenging for security teams.
Kill Chain
