Mac users are being targeted by a sophisticated malware campaign disguised as a legitimate cryptocurrency wallet. The fake download delivers a fresh variant of PamStealer, engineered to harvest Mac login credentials and other sensitive data. Unlike earlier versions, this variant demands active user interaction and engages with an attacker-controlled server to unlock its full payload.
How the Impersonation Works
The attack begins with a website offering a Mac disk image (.dmg) named “Wavel.dmg,” which looks like a typical crypto wallet app. Inside this .dmg is a script with an almost invisible name—only its file extension shows up, obscured by Mac Finder’s default settings. When the user opens the script, they’re led through a set of instructions that activates a hidden background chain reaction.
Initially, the disguised script decodes and executes another script behind the scenes. It downloads a decryption utility and then reaches out to a remote server to fetch the keys needed to unlock an encrypted application bundle. This server interaction occurs anew each time the malware runs, preventing researchers from easily analyzing the payload from the initial download alone.
Stealing Passwords and Ensuring Persistence
Once fully installed, the malware registers itself as a built-in component, suppresses notifications that normally alert users to background activity, and achieves persistence via login agents. It uses repair routines—hooked into shell sessions and Git workflows—to restore any parts removed by the user or security tools.
This version of PamStealer is written in Swift (a shift from Rust in earlier variants) and employs a deceptive Mac-like login prompt. If a password is submitted, it checks legitimacy through the system’s native login mechanism before tapping into secured resources. Targeted data includes the system Keychain credential store and login keychain database, as well as credentials from 17 different web browsers, including smaller, less common ones.
Beyond credentials, the malware grabs system information, shell command history, and user profile photos. In observed sandbox tests, stolen data was compressed and transmitted to attacker-controlled infrastructure, indicating that the chain of theft—from execution to exfiltration—is intact.
Indicators & Mitigations
Security experts have identified several indicators of compromise (IoCs) that users and defenders should watch for: the domains wavel[.]app and wavel.apple03cloudstore[.]com; filenames such as Wavel.dmg, .scpt, and Wavel.applescript; and file hashes including ed980f2fa0642b1a5ba0bca65f5b3baee8a7b3f5d149bf295aa4ac7a70b92cec for the compiled script. Malicious persistence is established through a LaunchAgent labeled com.apple.finder.agent, and repair mechanisms embedded via Git hooks and shell configuration files.
To guard against this threat, users should verify downloads, especially unexpected ones, and never run scripts whose origin or behavior is suspicious. On the defensive side, security controls can block malicious domains, inspect persistence mechanisms, and after containment, reset any credentials accessed using a device known to be clean.
This new variant represents a significant evolution in the PamStealer lineage. By mimicking cryptocurrency wallet software rather than simpler tools, relying on user involvement, and using server-mediated payload unlocking, it raises the bar for detection and containment. Mac users and security teams alike will need extra vigilance to counter this threat.
What this means: malware distribution is increasingly leaning on social engineering blended with dynamic payload delivery. The use of legitimate-looking software as a disguise suggests attackers are optimizing for trust exploitation. For defenders, detecting file behavior and launch agents may be just as crucial as identifying malicious binaries. Monitoring anomalous login prompts or Keychain access may become key early warning signs.
