Fake Crypto Wallet Spreads PamStealer On Mac

A new version of the PamStealer macOS malware is being distributed through a fake cryptocurrency wallet app designed to look like a legitimate multichain wallet.

The malware can steal Mac passwords, browser data, Keychain information, cryptocurrency wallet details, Git settings, and sensitive files.

The latest campaign also uses a more advanced delivery method, making the malware harder to analyze and remove.

Fake Wavel Wallet Delivers the Malware

The attack starts with a fake website pretending to offer a cryptocurrency wallet called Wavel.

When users click “Download for macOS,” they receive a malicious disk image containing a compiled AppleScript file with a .scpt extension.

The file uses embedded JXA code to launch a shell command. Instead of keeping the entire malware directly inside the script, the attacker uses an encoded Base64 payload that is decoded and passed to /bin/zsh.

The next stage downloads a Mach-O utility called pkgunpack. It supports both Apple Silicon and Intel Macs and uses encryption techniques including X25519, SHA-256, and AES-256-GCM to unlock the next-stage payload.

A fresh key pair is generated for every infection, while the attacker’s server provides the key needed to decrypt the payload. This means the encrypted payload cannot simply be recovered through static analysis.

PamStealer Adds Multiple Persistence Methods

After decryption, the malware installs a fake Wavel.app inside:

~/Library/Application Support/System/Finder.app

It then creates a LaunchAgent called:

com.apple.finder.agent

This allows the malware to start when the user logs in, restart after a crash, and run repeatedly.

PamStealer also uses additional methods to survive removal attempts, including changes to:

~/.zshrc
Global Git hooks
Local repair scripts
LaunchAgent configuration

The malware also attempts to hide background-item notifications while setting up persistence.

This layered approach means removing one malicious component may not be enough to completely remove the infection.

Malware Steals Passwords and Browser Data

The main stealer, identified as MacClient, displays a fake macOS password request followed by a misleading damaged-application warning.

The entered password is checked locally using macOS authentication mechanisms before being sent to the attackers.

PamStealer also targets data from 17 different browsers, including Chrome, Edge, Brave, Opera, Firefox, Arc, Zen, Waterfox, LibreWolf, Yandex Browser, and CocCoc.

The malware can also look for:

Keychain information
Cryptocurrency wallet data
Browser extensions
Shell history
Git configuration
Login Keychain data
System information
The macOS account photo

The stolen information is compressed into a ZIP archive and uploaded to attacker-controlled infrastructure.

How to Stay Protected

Organizations should look for suspicious Finder.app files, unexpected com.apple.finder.agent LaunchAgents, unusual Git hooks, and unexpected .zshrc changes.

Security teams can also block the domains associated with the campaign and investigate suspicious network traffic containing the identified upload header.

For Mac users, the safest approach is to download cryptocurrency wallet applications only from verified vendor websites and avoid opening unexpected .scpt files, especially when they arrive inside disk images.

A fake wallet application can look legitimate while quietly giving attackers access to highly sensitive information.