Forest Global Training Partners

Cyber Risks · The Hacker News

Pam Stealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Summary: Jamf Threat Labs reported a new PamStealer variant that keeps its JXA dropper but now fetches a decryption utility and completes a key exchange with the server before the payload can be unwrapped, so the payload cannot be recovered statically without server cooperation. Victims are lured through a fake site, wavel[.]app, advertising a non-existent cryptocurrency wallet called Wavel, whose Wavel.dmg contains a compiled AppleScript that opens Script Editor and pipes a decoded base64 string into /bin/zsh, while the final Swift stealer targets Arc, Zen and regional and privacy-focused browsers.

Bottom line: Because a new ephemeral keypair is generated on every execution and the server holds the private key, a captured Data Encryption Key cannot be replayed, so defenders cannot decrypt the payload without a live command-and-control session. The installer also sets git config --global core.hooksPath to ~/Library/Application Support/System/.githooks/, meaning any git checkout or git commit in any repository on the machine silently runs the repair script.

Read the original at The Hacker News ↗

Topics
Malware
Related