PamStealer now decrypts its macOS payload only through a live handshake with its C2 server

The change that matters is in the JavaScript for Automation layer. In the Maccy, Scoppr and Nancy Clipboard builds seen in July and August 2026, the JXA source did the work itself: RC4 decryption of the embedded payload, Objective-C calls through JXA's bridge to Foundation and NSData, and the download and staging routine ^[7]. In Wavel, that code is gone. Script Editor decodes a base64 string and pipes the bytes into /bin/zsh -s; the JXA process exits and the zsh dropper runs in the background ^[8].

The dropper pulls a utility called pkgunpack from wavel.apple03cloudstore[.]com and runs an X25519 key exchange before it can decrypt and stage the payload bundle ^[9]. The server holds the private key that completes the exchange, so the Data Encryption Key cannot be derived without it ^[10]. A fresh ephemeral keypair is generated on every run. A key captured from one infection cannot be replayed against another ^[11].

"Without the server's cooperation, the payload cannot be recovered statically," Jamf's Thijs Xhaflaire said ^[3].

For anyone triaging a captured sample, the encrypted bundle on disk is inert ^[12]. Recovering the payload now requires a live C2 session. The detection that remains sits on the network and in runtime behavior.

Persistence is layered. The dropper suppresses the macOS notification that fires when a background login item is added, then installs a LaunchAgent, a repair script that restores both the payload and the agent if either goes missing, and a hook in ~/.zshrc that runs the repair script on every new interactive shell ^[13][18]. It also copies the repair script into post-checkout and pre-commit folders under ~/Library/Application Support/System/.githooks/ and points git config --global core.hooksPath at that directory. Any checkout or commit in any repository on the machine then silently runs the script ^[14].

The stealer itself is written in Swift, a switch from the Rust of earlier builds, though the goal is unchanged ^[15]. It serves a fake crash dialog to capture the login password and validates it through PAM, reads keychain items, and pulls credentials from Chromium- and Firefox-based browsers ^[16]. That list runs to 13 ^[19], and includes some unusual choices. "The inclusion of Arc, Zen and the less common regional and privacy-focused browsers extends the target list noticeably beyond what is typical in commodity macOS stealers," Xhaflaire said ^[17].