# New macOS Stealer Variant Uses Server-Side Decryption to Evade Static Analysis
A recently identified strain of macOS-focused malware, tracked by cybersecurity analysts, has evolved its delivery and encryption strategy to make static analysis virtually impossible without active access to its command-and-control infrastructure. The threat, known in detection circles as a descendant of the broader PamStealer family, represents a significant escalation in how cybercriminals target Apple ecosystems.
## How the Attack Begins
The infection chain starts with a social engineering tactic. Victims are directed to a fraudulent website — hosted on a domain mimicking a legitimate service — that advertises a fictional cryptocurrency wallet application for macOS. The site features a “Download for macOS” button that, when clicked, delivers a disk image file (.dmg) to the user’s machine.
Inside this disk image lies a compiled AppleScript file. When executed, it automatically opens macOS’s native Script Editor application, which displays seemingly harmless instructions. In reality, these instructions are a carefully concealed JavaScript for Automation (JXA) dropper, designed to silently launch a secondary shell-based payload in the background.
## A Shift in Payload Delivery Architecture
What makes this latest iteration particularly notable is how it handles payload decryption. Previous versions of the malware embedded encryption keys directly within the dropper script, allowing researchers to recover the main payload through offline analysis. This new version completely abandons that approach.
Once the JXA dropper executes, it decodes a base64-encoded string and pipes the result into the system shell, where it reads and processes instructions from standard input. At this point, the dropper process terminates, and a separate shell script takes over the infection chain.
The shell script then connects to a remote server to download a purpose-built decryption tool. It initiates an ephemeral cryptographic key exchange using the X25519 algorithm, requesting a Data Encryption Key (DEK) that is only available in real time from the attacker’s server. Because a fresh key pair is generated with every execution and the private component never leaves the server, capturing the DEK at any single point does not allow for retroactive decryption.
This server-dependent architecture means that without a live command-and-control session, the encrypted payload bundle cannot be unpacked or examined offline — rendering traditional static analysis methods ineffective.
## Persistence and Evasion Techniques
Once the payload is decrypted and staged locally, the malware implements multiple layers of persistence to ensure continued access. It installs four redundant mechanisms through LaunchAgent, deploys a repair script capable of restoring both the payload and its persistence entries if either is removed, and appends a trigger to the user’s `.zshrc` configuration file that executes the repair script every time a new interactive shell session begins.
The malware also takes steps to suppress macOS notifications, preventing the system from alerting users when new background login items are registered. Additionally, the repair script is surreptitiously placed inside Git hook directories — specifically the `post-checkout` and `pre-commit` paths within the user’s application support folder — with the system’s Git configuration pointed to that directory. This means that any routine Git operation performed by the user on any repository will silently reactivate the repair mechanism.
## Stealth and Data Exfiltration
The final payload component, written in Swift, is responsible for harvesting sensitive data from the compromised machine. Its capabilities include:
– **Credential theft** via a fake crash dialog that captures the user’s macOS login password, validated against the system’s native authentication framework
– **Keychain enumeration**, extracting stored credentials managed by Apple’s built-in password manager
– **Browser credential harvesting**, targeting an extensive list including Google Chrome, Microsoft Edge, Mozilla Firefox, Brave, Vivaldi, Opera, Opera GX, Arc, Zen, Waterfox, LibreWolf, Yandex Browser, and Cốc Cốc
– **System fingerprinting**, collecting detailed metadata and the user’s profile photo
– **File collection**, capturing shell history files, shell configuration files, and Git configuration files
– **Process and application enumeration**, listing all running processes and installed software
Security researchers have noted that the breadth of targeted browsers — particularly the inclusion of privacy-oriented and region-specific applications — is unusually extensive compared to other commodity macOS stealers circulating in the wild.
## Why This Matters
The evolution of this malware demonstrates a clear investment in defensive evasion. By tying payload decryption to live server communication and using ephemeral cryptographic keys that cannot be replayed, the operators ensure that their tools remain opaque to analysts, incident responders, and automated detection systems. The layered persistence mechanisms further complicate remediation, as the malware can recover itself even after partial removal attempts.
For organizations and individuals using macOS, this threat underscores the importance of maintaining up-to-date security software, exercising caution when downloading applications from unfamiliar websites, and monitoring for unusual outbound network connections from endpoints.
—
## Frequently Asked Questions (FAQ)
**Q: What is PamStealer?**
A: PamStealer is a family of macOS-targeting malware designed to steal credentials, system information, and sensitive data from infected machines. It has evolved over multiple versions, each introducing new evasion and persistence techniques.
**Q: How does the new variant differ from earlier versions?**
A: The latest variant shifts payload decryption to a server-side process using ephemeral X25519 key exchanges, making static analysis of the encrypted payload impossible without live command-and-control access. Earlier versions embedded decryption keys directly in the dropper scripts.
**Q: What is the initial lure used in this campaign?**
A: Victims are directed to a fake website advertising a non-existent cryptocurrency wallet service for macOS. Downloading the application delivers a disk image containing a malicious AppleScript that triggers the infection chain.
**Q: What programming languages are used in this malware?**
A: The latest version uses Swift for the final stealer component. Previous versions were written in Rust. The dropper and intermediary stages use shell scripting and JavaScript for Automation.
**Q: How does the malware maintain persistence?**
A: It uses four redundant LaunchAgent entries, a self-repairing script, and a shell hook embedded in the user’s `.zshrc` file. It also places repair scripts inside Git hook directories so that routine Git operations silently reactivate the malware.
**Q: Which browsers are targeted by the stealer component?**
A: The malware targets credentials from Google Chrome, Microsoft Edge, Mozilla Firefox, Brave, Vivaldi, Opera, Opera GX, Arc, Zen, Waterfox, LibreWolf, Yandex Browser, and Cốc Cốc.
**Q: Can static analysis tools detect the payload?**
A: No. Because the payload is encrypted and the decryption key is only available through a live server session, static analysis tools cannot recover or examine the second-stage payload without access to the command-and-control server.
**Q: What should macOS users do to protect themselves?**
A: Users should avoid downloading software from untrusted websites, keep their operating system and security tools up to date, monitor system notifications for unauthorized changes, and use multi-factor authentication for critical accounts.
—
## Conclusion
The latest iteration of PamStealer demonstrates that macOS malware operators are continuously refining their techniques to stay ahead of detection and analysis. By leveraging server-dependent decryption, ephemeral cryptographic key exchanges, and aggressive multi-layered persistence, this variant presents a formidable challenge for defenders. As macOS continues to grow in enterprise adoption, threats of this sophistication will likely increase in frequency and complexity. Staying informed, adopting robust endpoint protection, and practicing vigilant security hygiene remain the most effective defenses against such evolving threats.
Thank you for reading
