Researchers at Jamf Threat Labs have uncovered a new campaign delivering the third known variant of PamStealer, a macOS password-stealing malware family, disguised as a legitimate cryptocurrency wallet application. The lure this time is a fake multichain wallet called “Wavel,” a departure from the clipboard-utility theme used in the malware’s earlier “PamStealer Maccy” campaign, though the core password-checking mechanism that gives the family its name remains intact.

The attack begins with a convincing wallet-themed website offering what looks like a standard Mac installer. Because Finder hides file extensions by default, the disk image actually contains a compiled script with a name deliberately chosen to look like an ordinary document. Opening it launches the file in Script Editor, where the victim is walked through instructions to run it manually — meaning, like many recent Mac-targeted campaigns, this attack depends entirely on convincing a user to take action rather than exploiting a software vulnerability.

A Harder Target for Researchers

What sets this third generation apart technically is how it protects its payload from analysis. Rather than bundling the malicious program directly inside the initial download, the script decodes and silently launches a second-stage script in the background once run. That script downloads a small decryption utility and requests the material needed to unlock an encrypted application from an attacker-controlled server — and because a fresh key exchange happens on every execution, researchers cannot simply capture the original download and analyze the hidden program offline later. Without access to the live command-and-control server at the time of infection, the payload effectively stays locked.

Once the exchange succeeds, the dropper strips the downloaded decryption tool’s quarantine flag, applies an ad hoc code signature to it, and runs it to unpack the final payload. During installation, the malware briefly interferes with the system processes that would normally alert the user to a new background item being added, then installs a login item that relaunches the stealer at every sign-in and periodically checks that it is still running.

Persistence Built to Survive Cleanup

The campaign includes repair mechanisms designed to survive a user or security tool partially removing the infection. Jamf found that the malware maintains a local backup of its components and attaches recovery triggers to routine developer activity, including new shell sessions and Git operations, so that a partial cleanup can be silently reversed.

What the Stealer Actually Takes

The core stealer component has been rewritten from Rust, used in the first PamStealer version, into Swift. Once active, it displays a realistic-looking macOS password prompt followed by a fake “damaged application” warning designed to explain away the odd behavior. When a victim enters their password, the malware validates it through the operating system’s normal login-verification mechanism before using it to unlock protected data, which helps ensure it captures a genuinely working credential rather than a mistyped one.

With a verified password in hand, the malware can retrieve items from the macOS Keychain and copy the login keychain database outright. It also targets stored credentials across seventeen different browsers, reaching well beyond the handful of mainstream options that many security tools focus on. Additional collection routines gather system information, shell history, and even the user’s account photo. Per-browser helper components attempt to access each browser’s stored secrets while masquerading as that browser itself.

In a controlled test, Jamf observed the malware package everything it collected into an archive and successfully upload it to attacker infrastructure, confirming that the full theft chain functions end-to-end. The researchers noted that their report does not include a victim count or financial loss figures, so the confirmed real-world impact is currently limited to what was observed in analysis rather than reported incidents.

Defensive Recommendations

Because this attack chain depends on user action rather than a software exploit, awareness and download hygiene remain the most effective defenses. Mac users and security teams should consider the following:

• Avoid downloading wallet or utility applications from unfamiliar or unverified websites, regardless of how polished the installer looks.
• Treat any prompt to manually run a script from Script Editor or a similar tool as a major red flag.
• Deploy endpoint threat and web-filtering controls capable of blocking known indicators associated with the campaign.
• Inspect systems for unexpected LaunchAgents, modified shell startup files, or suspicious Git hooks, all of which this campaign uses for persistence and recovery.
• Reset any potentially exposed passwords from a separate, clean device once an infected Mac has been secured.

Given the malware’s reliance on live infrastructure to decrypt its payload, organizations that identify a suspected infection should also move quickly to preserve network logs, since the decryption keys and staged payload may not be recoverable once the attacker-controlled server stops responding.