Fake Crypto Wallet Site Delivers PamStealer to Steal macOS Credentials

A fraudulent multichain cryptocurrency-wallet website is distributing a third known variant of the macOS information stealer PamStealer through the Wavel.dmg disk image. The campaign uses social engineering to persuade victims to run a disguised compiled script, which contacts attacker-controlled infrastructure for material needed to decrypt and install the next-stage Swift-based payload. Jamf Threat Labs identified the activity; no victim count or financial-loss estimate was reported.

PamStealer captures and validates macOS login passwords, extracts Keychain data, targets credential stores from 17 browsers, and collects system and user information including shell history and account photos. It packages the stolen data for upload to attacker infrastructure and maintains access by masquerading as Finder.app, creating a LaunchAgent, modifying shell profiles, using Git hooks and backups, and employing repair routines linked to shell sessions and Git activity while suppressing background-item notifications.