PamStealer macOS Malware Adds Live C2 Payload Decryption

Jamf Threat Labs flagged a new PamStealer variant that can only recover its main payload via a server-side decryption chain. The macOS stealer still uses a JavaScript for Automation (JXA) dropper but changes the lure, delivery method, and adds multi-layer persistence.

• New PamStealer variant decrypts its payload only via a server-side C2 chain
• Dropper still relies on JavaScript for Automation (JXA)
• Lure and delivery method were modified
• Malware adds multi-layer persistence on macOS