#pamstealer

Jamf Threat Labs found a PamStealer macOS variant that withholds its main payload until live X25519 key exchange and server-assisted decryption. This blocks offline analysis and relies on AppleScript, JXA and zsh loaders with multi-layer persistence. Hunt for JXA execution and anomalous C2 sessions. #PamStealer #MacOSMalware #ThreatIntel

Newly discovered #PamStealer isn’t your typical #macOS #malware https://arstechnica.com/security/2026/07/new-pamstealer-macos-malware-uses-clever-tradecraft-to-remain-stealthy/ #cybersecurity #apple #infostealer