Fake Crypto Wallet App Spreads PamStealer to Steal macOS Passwords

Key Takeaways

• A new variant of PamStealer malware is being distributed via fake cryptocurrency wallet applications targeting macOS users.
• This third PamStealer iteration employs a sophisticated multi-stage infection process, requiring live interaction with an attacker-controlled server to deliver its payload.
• The malware masquerades as a legitimate system component, establishes persistent access, and is designed to steal macOS login passwords, Keychain data, and credentials from 17 different web browsers.
• The attack relies on social engineering, tricking users into manually executing a malicious script rather than exploiting a software vulnerability.
• Users should exercise extreme caution with cryptocurrency wallet downloads and implement strong security practices to mitigate risks.

A deceptive cryptocurrency wallet application is actively deploying a newly evolved version of the PamStealer malware, specifically engineered to compromise macOS systems. This sophisticated attack begins with a meticulously crafted website that prompts users to download what appears to be a legitimate wallet application, then guides them through a series of instructions to initiate the malicious payload.

Executing the disguised installer unleashes a clandestine infection chain capable of exfiltrating macOS login credentials and other sensitive personal data. This latest iteration marks the third known variant of PamStealer, showcasing increased stealth and resilience against detection compared to its predecessors.

Unlike earlier versions that embedded the malicious payload directly within the initial download, this new variant adopts a more dynamic approach. It establishes a live connection with a command-and-control (C2) server operated by the attackers to retrieve and unlock subsequent stages of the malware. This design significantly complicates analysis for cybersecurity researchers, as the full payload cannot be examined without active communication with the C2 infrastructure.

Analysts at Jamf Threat Labs were instrumental in identifying this novel PamStealer variant, building upon their previous tracking of earlier PamStealer operations. Jamf said in a report shared with Cyber Security News (CSN) that the current lure impersonates a “multichain wallet,” diverging from the “Maccy” clipboard utility used in prior campaigns. Despite this change in disguise, the malware retains its core password-checking methodology.

During a controlled environment test, researchers observed the stealer successfully compiling and uploading an archive of stolen information. While the report does not detail victim counts or financial losses, the demonstrated capabilities—including password theft, browser data collection, and persistent access—underscore significant risks for any user who falls prey to this installer.

Fake Crypto Wallet App Spreads PamStealer Malware

The attack vector originates from a cryptocurrency wallet-themed website offering what appears to be a standard Mac application download. However, the downloaded disk image contains a compiled script with an obfuscated filename, often displaying only its file extension. Given that macOS Finder typically conceals file extensions, the item may initially look like an innocuous document. The user is then prompted to open it in Script Editor and follow instructions to run it.

This attack hinges on social engineering, compelling the user to manually initiate the malicious sequence rather than exploiting a software vulnerability. Once executed, the initial script decodes and launches a secondary script in the background, allowing the visible Script Editor window to close while the infection proceeds silently.

The background script then proceeds to download a compact decryption utility and requests essential decryption components from the attacker’s server. This dynamic exchange occurs with each execution, preventing investigators from simply extracting and analyzing the hidden program offline. Furthermore, the dropper removes the downloaded tool’s macOS quarantine flag and applies an ad hoc signature before execution, further evading detection mechanisms.

Following payload unpacking, the script installs the malware as a seemingly legitimate macOS system component. It briefly obstructs system processes that would normally display notifications about new background items. A login item is then established, ensuring the stealer relaunches automatically upon user sign-in and is regularly checked for integrity. Integrated repair mechanisms can even restore components if they are removed by a user or security software.

Password Theft And Staying Power

The primary stealer component has been rewritten in Swift, replacing the Rust-based module observed in the initial PamStealer variant. It presents a convincing macOS password prompt, followed by a fake “damaged application” warning. When a user inputs their password, the malware validates it via the system’s legitimate login mechanism before leveraging it to access protected information.

The malware is designed to retrieve sensitive data from macOS Keychain and to copy the entire login keychain database. It also targets credential databases across an extensive list of 17 web browsers, encompassing both popular and less common choices. Similar to other fake macOS installers, the convincing initial download is merely the gateway; the true threat emerges as private data is systematically harvested and transmitted to the attackers.

Researchers also identified routines for collecting system details, shell history, and the user’s account photo. Specialized helper applications, designed to mimic legitimate browsers, attempt to access stored secrets within each browser’s context. During the sandbox analysis, the malware successfully packaged its collected findings into an archive and uploaded it to attacker-controlled infrastructure, confirming the full exfiltration chain.

Removing the malware can be challenging due to its sophisticated persistence mechanisms, including a stored backup and repair triggers associated with new shell sessions and Git activity. macOS users are strongly advised to meticulously verify the authenticity of all downloaded applications and to exercise extreme caution with any unexpected scripts.

What You Should Do

• Verify Software Sources: Always download cryptocurrency wallet applications and any other software directly from official vendor websites or trusted app stores. Avoid third-party download sites or links from suspicious emails.
• Exercise Caution with Scripts: Be extremely wary of any downloaded file that prompts you to open it in Script Editor or execute it manually. Legitimate applications rarely require such steps for installation.
• Enable File Extension Visibility: Configure macOS Finder to always show file extensions. This can help identify disguised malicious scripts.
• Use Strong, Unique Passwords: Employ robust, distinct passwords for all accounts, especially for your macOS login and cryptocurrency wallets. Consider a reputable password manager.
• Enable Multi-Factor Authentication (MFA): Implement MFA wherever possible, particularly for cryptocurrency exchanges and wallet services, to add an extra layer of security.
• Install and Maintain Antivirus/EDR: Ensure your macOS device has up-to-date antivirus or Endpoint Detection and Response (EDR) software capable of detecting and blocking malware.
• Regularly Back Up Data: Maintain regular backups of critical data to an offline storage solution.
• Monitor Network Activity: For organizations, monitor network traffic for connections to known malicious domains or unusual outbound data transfers.
• Reset Exposed Passwords: If you suspect compromise, immediately reset all passwords, especially your macOS login and any cryptocurrency-related credentials, from a clean, trusted device.
• Inspect Persistence Mechanisms: Security professionals should inspect common macOS persistence locations (e.g., LaunchAgents, login items) for suspicious entries.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.