CERT24New PamStealer macOS version adds server-side payload decryption and multi-layer persistenceLoading data…
CERT24Threat Observatory
Period

New PamStealer macOS version adds server-side payload decryption and multi-layer persistence

The new PamStealer version described by Jamf Threat Labs uses a JXA dropper whose main payload is decrypted through a server-side key exchange. The variant is delivered through a fake Wavel cryptocurrency-wallet website and includes multiple persistence mechanisms and an information-stealing component.

← Back to intelligence

New PamStealer macOS version adds server-side payload decryption and multi-layer persistence

The new PamStealer version described by Jamf Threat Labs uses a JXA dropper whose main payload is decrypted through a server-side key exchange. The variant is delivered through a fake Wavel cryptocurrency-wallet website and includes multiple persistence mechanisms and an information-stealing component.