Threats Tagged 'pam validation'

A third variant of PamStealer has been identified, distributed through a fake Wavel cryptocurrency wallet application. The malware employs a sophisticated server-side decryption chain using a purpose-built utility called pkgunpack that performs live ECIES key exchange with command-and-control infrastructure, making offline payload decryption impossible. The second stage has been rewritten from Rust to Swift while maintaining PAM-based credential validation. The infostealer targets seventeen browsers including Arc, Zen, Waterfox, and LibreWolf, extracts keychain credentials, collects system fingerprints, and harvests user files including shell history and account photos via Open Directory. Persistence is maintained through four redundant repair mechanisms including LaunchAgent installation, shell hooks, Git hooks, and a local backup tarball, with notification suppression achieved by killing background task management processes.