This third variant of PamStealer is distributed via a fake Wavel cryptocurrency wallet for macOS. It employs a sophisticated server-side decryption chain using a custom utility called pkgunpack that performs live ECIES key exchange with its command-and-control servers, making offline payload decryption impossible. The malware’s second stage is rewritten from Rust to Swift, maintaining PAM-based credential validation. It targets seventeen browsers including Arc, Zen, Waterfox, and LibreWolf to steal credentials, extracts keychain credentials, collects system fingerprints, and harvests user files such as shell history and account photos via Open Directory. Persistence is maintained through four redundant repair mechanisms: LaunchAgent installation, shell hooks, Git hooks, and a local backup tarball. Notification suppression is achieved by killing background task management processes. Indicators include multiple URLs and hashes associated with the malware distribution and command infrastructure.

The malware compromises macOS systems by stealing sensitive user credentials from multiple browsers and the system keychain, collecting system fingerprint data, and exfiltrating user files including shell history and account photos. It maintains strong persistence through multiple redundant mechanisms, making removal difficult. The use of live ECIES key exchange for payload decryption prevents offline analysis and complicates detection and mitigation. Notification suppression reduces user awareness of the infection.

No official patch or fix is available as this is malware rather than a software vulnerability. Mitigation involves user education to avoid downloading and installing fake cryptocurrency wallet applications, especially from untrusted sources. Endpoint detection and response solutions should be updated to detect indicators of compromise such as the known URLs, domains, and file hashes associated with this malware. Monitoring for persistence mechanisms like LaunchAgent installations, shell hooks, and Git hooks on macOS systems can aid in detection. Due to the sophisticated encryption and persistence, removal may require specialized incident response procedures.