Malware

Wavel

Tracked since Sep 23, 2026 · Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK17Techniques

IOCs0Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

Les victimes sont attirées vers hxxps://wavel[.]app, un site imitant une application de portefeuille crypto multichain.

Execution

3 techniques

T1059.002AppleScriptEvidence1

Le DMG contient un AppleScript compilé (.scpt) ... s’ouvre avec Script Editor et exécute du code JXA embarqué.

T1059.004Unix ShellEvidence1

Le fichier JXA contient une large chaîne base64 décodée et exécutée via /bin/zsh -s.

T1204.002Malicious FileEvidence2

Le bouton de téléchargement délivre un fichier Wavel.dmg ... Le DMG contient un AppleScript compilé (.scpt).

Persistence

2 techniques

T1543.001Launch AgentEvidence1

LaunchAgent com.apple.finder.agent (exécution toutes les 15 secondes).

T1546.004Unix Shell Configuration ModificationEvidence1

Hook shell ajouté à ~/.zshrc.

Privilege Escalation

2 techniques

T1543.001Launch AgentEvidence1

LaunchAgent com.apple.finder.agent (exécution toutes les 15 secondes).

T1546.004Unix Shell Configuration ModificationEvidence1

Hook shell ajouté à ~/.zshrc.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence2

Le fichier JXA contient une large chaîne base64 décodée ... Le payload ... est chiffré et récupéré sous les formats SNWK1 et SNP1.

T1036MasqueradingEvidence1

Its disk image instead contains a compiled script with an almost invisible name: only its file extension is shown... The installed bundle name used to resemble a system component is Finder.app.

T1036.005Match Legitimate Resource Name or LocationEvidence1

Extrait une archive tar.gz contenant Wavel.app, renommée en Finder.app lors de l’installation.

T1564.001Hidden Files and DirectoriesEvidence1

Le DMG contient un AppleScript compilé (.scpt) qui, masqué par macOS (extension cachée dans Finder) ...

Defense Impairment

2 techniques

T1553.002Code SigningEvidence1

T1553.002 — Subvert Trust Controls: Code Signing (Defense Evasion).

T1685Disable or Modify ToolsEvidence1

Supprime la notification macOS d’ajout d’élément de connexion en arrière-plan (SIGSTOP/SIGKILL sur les processus système).

Credential Access

3 techniques

T1056.002GUI Input CaptureEvidence1

Capture de mot de passe via une fausse fenêtre d’authentification AppKit (AuthPromptWindow) validée par PAM.

T1555.001KeychainEvidence1

Extraction du trousseau via _SecItemCopyMatching + security unlock-keychain + copie directe de login.keychain-db.

T1555.003Credentials from Web BrowsersEvidence1

Vol de bases de données navigateurs (17 cibles) via l’API SQLite backup, après kill forcé des processus helper.

Collection

1 technique

T1056.002GUI Input CaptureEvidence1

Capture de mot de passe via une fausse fenêtre d’authentification AppKit (AuthPromptWindow) validée par PAM.

Command and Control

1 technique

T1573.001Symmetric CryptographyEvidence1

pkgunpack ... dédié au déchiffrement ECIES (X25519 + AES-256-GCM) ... récupère un DEK chiffré depuis le serveur C2.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

T1041 — Exfiltration Over C2 Channel (Exfiltration).

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cyberveilleNews · Sep 27, 2026PamStealer Wavel : nouvelle variante Swift avec déchiffrement côté serveur sur macOS | CyberVeilleVariante macOS de PamStealer distribuée via un faux portefeuille crypto. Elle emploie un dropper AppleScript/JXA et zsh, un déchiffrement de payload dépendant du serveur C2, et une persistance par LaunchAgent, .zshrc et hooks Git. Son second étage Swift vole les mots de passe via une fausse invite d’authentification, extrait le trousseau macOS et dérobe les bases de données de navigateurs.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matchingMatch every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

Wavel

Tracked since Sep 23, 2026 · Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors0Associated

ATT&CK17Techniques

IOCs0Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure