PamStealer macOS Malware Deploys Live C2 Decryption and Multi‑Layer Persistence
What Happened – Researchers at Jamf Threat Labs identified a new variant of the PamStealer macOS credential‑stealer. The malware now encrypts its main payload on the host and requires a live server‑side decryption chain to recover it, while retaining the original JXA dropper and adding several persistence hooks that survive reboots and user log‑outs.
Why It Matters for Trust & Control Assurance
- Demonstrates how attackers can hide malicious code behind server‑controlled encryption, making static file‑hash checks insufficient.
- Highlights the need for continuous endpoint monitoring, real‑time logging, and evidence collection to prove that detection controls are operating as intended.
- Aligns with the control objective of “monitoring and logging of endpoint activity” – a single control that satisfies audit requirements across SOC 2, ISO 27001, NIST CSF, and others.
Who Is Affected – Any organization that deploys macOS devices, especially those in technology, finance, education, and professional services where privileged macOS workstations are common.
Recommended Actions
- Verify that endpoint protection solutions on macOS can inspect JXA scripts and detect anomalous process injection.
- Enable detailed system‑call and file‑integrity logging, and feed those logs into a SIEM for continuous correlation.
- Map your detection and logging controls to the Verisq Common Framework (VCF) to obtain defensible audit evidence.
Technical Notes – The dropper uses JavaScript for Automation (JXA) to execute a native payload, modifies its lure to evade sandbox analysis, and establishes multi‑layer persistence via launch agents, login items, and kernel extensions. The payload remains encrypted on disk until a live C2 request returns the decryption key. Source: The Hacker News