PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence
-
Cybersecurity researchers at Jamf Threat Labs have flagged a new version of PamStealer, a macOS information stealer, that introduces a server-side decryption chain for its main payload. This design ensures the payload can only be recovered through a live command-and-control (C2) interaction, complicating static analysis and automated sandbox detonation.
The latest artifacts continue to use the same JavaScript for Automation (JXA) dropper mechanism seen in earlier variants, but the lure content and delivery method have been modified. According to the researchers, previous versions embedded their payload key material directly, whereas the newer build now relies on the C2 server to supply the necessary decryption material at runtime. This means defenders cannot simply extract and decrypt the payload offline — the malware must reach its operator's infrastructure before the final stage is revealed.
Key technical points from the analysis:
- The main payload is only recoverable via a server-side decryption chain, preventing offline extraction.
- Delivery still relies on a JXA dropper, a common Living-off-the-Land technique on macOS.
- The lure and delivery method have been changed compared to earlier PamStealer variants.
- Earlier variants embedded payload key material locally; the new version does not.
- The malware also implements multi-layer persistence, according to the researchers.
Because the article does not specify particular affected macOS versions, indicators of compromise, or mitigation guidance beyond the payload decryption and persistence behavior, defenders are advised to monitor for unusual JXA execution and unexpected outbound connections to unknown infrastructure.
Source: The Hacker News
Has your organization observed any JXA-based droppers or suspicious C2 callbacks on macOS endpoints recently?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login