The latest artifacts continue to use the same JavaScript for Automation (JXA) dropper mechanism seen in earlier variants, but the lure content and delivery method have been modified. According to the researchers, previous versions embedded their payload key material directly, whereas the newer build now relies on the C2 server to supply the necessary decryption material at runtime. This means defenders cannot simply extract and decrypt the payload offline — the malware must reach its operator's infrastructure before the final stage is revealed.

Key technical points from the analysis:

• The main payload is only recoverable via a server-side decryption chain, preventing offline extraction.
• Delivery still relies on a JXA dropper, a common Living-off-the-Land technique on macOS.
• The lure and delivery method have been changed compared to earlier PamStealer variants.
• Earlier variants embedded payload key material locally; the new version does not.
• The malware also implements multi-layer persistence, according to the researchers.

Because the article does not specify particular affected macOS versions, indicators of compromise, or mitigation guidance beyond the payload decryption and persistence behavior, defenders are advised to monitor for unusual JXA execution and unexpected outbound connections to unknown infrastructure.

Source: The Hacker News

Has your organization observed any JXA-based droppers or suspicious C2 callbacks on macOS endpoints recently?