🤖 New PamStealer macOS variant decrypts its payload live from C2 and adds multi-layer persistence. JXA dropper updated with new lure and delivery, per Jamf Threat Labs.
No BS check run yet — press ⚖ to extract this story's claims and verify them against independent sources.
🤖 New PamStealer macOS variant decrypts its payload live from C2 and adds multi-layer persistence. JXA dropper updated with new lure and delivery, per Jamf Threat Labs. 🔗 https:// thehackernews.com/2026/09/pams tealer-macos-malware-adds-live-c2.html # Malware # ReverseEngineering # CyberSec
Hacker News: PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence https:// thehackernews.com/2026/09/pams tealer-macos-malware-adds-live-c2.html # news # IT
🤖 PamStealer macOS stealer evolved: the payload is now unwrapped through a server-side key exchange, so it can't be decrypted statically without C2 cooperation. Lure switched from fake clipboard apps to wavel[.]app, a bogus crypto wallet whose DMG drops a JXA loader piped into /bin/zsh -s. Analysis by Jamf Threat Labs. 🔗 https:// thehackernews.com/2026/09/pams tealer-macos-malware-adds-live-c2.h