PamStealer macOS Malware Evolves with Advanced C2 Decryption

Cybersecurity researchers at Jamf Threat Labs have uncovered an advanced version of the PamStealer malware specifically targeting macOS systems. This iteration introduces significant improvements in evasion techniques, including live command-and-control payload decryption that makes static analysis extremely difficult.

The malware continues to leverage JavaScript for Automation (JXA) as its primary dropper mechanism, but now incorporates enhanced delivery methods and social engineering lures. These changes indicate a growing sophistication in macOS-targeted threats that enterprise security teams need to address through improved detection and response capabilities.

Technical Enhancements in Payload Delivery

• Main payload now requires server-side decryption chain for recovery
• Previous versions embedded payload key material directly in code
• Live C2 decryption prevents static analysis of malicious components
• Multi-layer persistence mechanisms increase removal difficulty

Detection and Mitigation Considerations

• Traditional signature-based detection may fail against live-decrypted payloads
• Security teams should monitor for unusual JXA execution patterns
• Network monitoring must detect anomalous C2 communication timing
• Endpoint detection should flag multi-layer persistence installation attempts
• User education critical for identifying updated social engineering lures

Sources

• PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence