Reinforced Encryption in PamStealer Malware
A newly enhanced version of the PamStealer malware for macOS has been identified by cybersecurity experts, introducing a server-side decryption method that complicates payload recovery. This development, highlighted by Jamf Threat Labs, signifies a shift towards more sophisticated attack strategies.
The malware continues to use JavaScript for Automation (JXA) as a dropper but has altered its delivery tactics. This includes the implementation of a decryption utility and a server-based key exchange, making static decryption impossible without server interaction, according to security researcher Thijs Xhaflaire.
New Decoy Tactics and Delivery Methods
Previous PamStealer versions utilized fake websites mimicking known applications. However, the latest approach involves a deceptive site promoting a fictitious cryptocurrency wallet, Wavel, leading unsuspecting users to download a malicious disk image file. This file triggers the execution of a JXA dropper upon opening, leveraging Apple’s Script Editor to execute malicious scripts.
Unlike its predecessors, this version of PamStealer uses a streamlined JXA layer, with the execution process shifting to a zsh script. This script performs key actions like downloading a decryption utility, executing a key exchange, and staging the payload bundle, all while avoiding detection by suppressing macOS notifications.
Persistence and System Compromise
The malware employs multiple persistence mechanisms to ensure its longevity on infected systems. These include setting up LaunchAgent and utilizing a repair script that reinstates the payload if removed. It also modifies shell configurations to trigger repairs during new sessions.
Moreover, the malware exploits Git hooks to activate repair scripts during repository actions, extending its reach and persistence imperceptibly across the system.
Data Theft and System Profiling
The final stage of PamStealer’s operation involves a component written in Swift, which marks a transition from the previous Rust-based implementation. This module’s objectives are comprehensive: capturing system passwords, extracting keychain items, and pilfering credentials from a wide range of browsers, including less common ones like Arc and Zen.
Additionally, it gathers extensive system data, including user profiles, running processes, and application lists, further underscoring its sophisticated design and broad target scope.
According to Xhaflaire, the inclusion of diverse browsers and the malware’s robust infrastructure highlight a significant investment in its delivery mechanisms, emphasizing its reliance on live server interactions to maintain operational control and resist static analysis.
