Fake Crypto Wallet App Delivers PamStealer Malware to Mac Users
A new PamStealer variant is targeting Mac users through a convincing fake cryptocurrency wallet application, designed to steal passwords and sensitive browser data.
A deceptive cryptocurrency wallet application is serving as the delivery mechanism for a new variant of the PamStealer malware, specifically targeting macOS users. The attack chain begins with a sophisticated website designed to mimic legitimate cryptocurrency wallet services, enticing users to download what appears to be a standard application. However, the downloaded disk image contains a compiled script that, when executed by the user, initiates a hidden infection process.
Unlike previous PamStealer variants that might embed malicious code directly within the initial download, this new iteration relies on a dynamic, live exchange with an attacker-controlled server to decrypt and deploy its payload. This approach significantly complicates analysis for security researchers, as the malicious components cannot be easily extracted and examined offline. The malware is designed to be stealthy, with the initial script running in the background after the user is tricked into executing it, often by following seemingly innocuous instructions.
The infection process involves downloading a small decryption tool from the attacker's server. This tool then communicates with the command-and-control infrastructure to retrieve the necessary components to decrypt and install the main PamStealer payload. The dropper also takes steps to evade detection by removing quarantine flags and applying ad-hoc signatures to the downloaded components before execution. Once unpacked, the malware attempts to establish persistence by creating login tasks that ensure it runs automatically upon system startup and can even repair itself if parts are removed.
The core PamStealer component, now written in Swift, presents a familiar-looking macOS password prompt to the user. It then displays a fake warning about a damaged application, aiming to elicit the user's login credentials. Crucially, the malware validates the entered password through the system's legitimate login mechanism before attempting to access protected information, making its actions appear more normal to the user and potentially bypassing some security checks.
Once it has obtained valid credentials, PamStealer proceeds to harvest sensitive data. This includes extracting items from the macOS Keychain, copying the entire login keychain database, and targeting credential databases across a wide range of 17 browsers, including less common ones. Beyond credentials, the malware also collects system details, shell history, and user account photos, compiling this information into an archive for exfiltration.
The exfiltration process involves packaging the collected data and sending it to attacker-controlled servers. Researchers observed this complete theft chain in controlled tests. Efforts to remove the malware can be complicated by stored backups and repair triggers that re-establish persistence through new shell sessions or Git activity.
While the report from Jamf Threat Labs does not provide specific victim counts or financial loss figures, the observed capabilities of this PamStealer variant highlight a significant risk to Mac users. The combination of credential theft, extensive browser data collection, and robust persistence mechanisms makes this a potent threat. Users are advised to exercise extreme caution with downloads, verify the legitimacy of software sources, and avoid executing unexpected scripts. Security professionals can implement threat and web controls to block malicious domains and URLs, monitor for persistence mechanisms, and be prepared to reset passwords on compromised systems.