TL;DR: A newer PamStealer variant moves its second stage to Swift and adds a server-cooperative ECIES decryption chain, according to Jamf Threat Labs, so the payload cannot be recovered statically without a live exchange. The design shrinks offline analysis value and pushes defenders to treat delivery, decryption, persistence, and collection as one linked workflow rather than isolated malware steps.
At a glance
What this is: Jamf Threat Labs documents a third PamStealer variant that uses a fake installer, a server-side decryption chain, and a Swift infostealer payload to make static recovery harder.
Why it matters: This matters because macOS infostealers now combine lure delivery, cryptographic staging, and layered persistence in ways that change what defenders must observe, block, and investigate.
Context
This article is about a macOS infostealer delivery chain, not just malware collection logic. The security gap is that the payload is no longer self-contained, so offline analysis, file inspection, and single-artifact review reveal less than the full attack path.
The central problem for identity teams is that the stealers target user credentials, keychain material, browser databases, and session-adjacent artefacts while hiding behind a fake application installer. That means the question is not only whether the binary runs, but how the entire chain survives from initial lure to data theft.
Key questions
A: Security teams should treat unsigned or unexpected macOS installers as high risk, especially when they impersonate legitimate apps or arrive through malvertising and download lures. Strong endpoint monitoring should look for abnormal use of osascript, security, dscl, and browser password access. Blocking execution, alerting on suspicious command line activity, and validating installer provenance are the fastest ways to reduce exposure.
Q: Why do server-side decryption chains make malware analysis harder?
A: Because the payload is no longer self-contained. If the sample needs a live key exchange or server-held private key to unwrap the payload, captured files may not reveal the second stage at all. That forces defenders to combine runtime interception, infrastructure analysis, and network evidence instead of relying on static reverse engineering alone.
Q: What are the signs that a macOS stealer is abusing native system trust paths?
A: Look for downloaded unsigned binaries that are re-signed, temporary script wrappers that hand off to shell interpreters, LaunchAgent registration, and suppression of background login-item notifications. Those behaviours show the operator is trying to appear like normal system activity while building persistence and user interaction points.
A: Treat that session as a broader identity compromise, not a single password event. Revoke active sessions, review stored credentials, investigate browser profile exposure, and check for any local persistence that could keep harvesting secrets after remediation. The combination usually means the attacker is collecting multiple identity artefacts at once.
Technical breakdown
How a compiled JXA wrapper becomes only the first stage
The initial .scpt file is not the real payload. It is a compiled JXA wrapper that base64-decodes a zsh script and passes execution to /bin/zsh -s, so the visible script is only a carrier. That design breaks simple static inspection because the meaningful logic lives in the decoded shell layer, not in the AppleScript container. The JXA stage also exits immediately, which reduces straightforward parent-child process visibility and makes later activity harder to attribute from a single process tree.
Practical implication: Treat compiled script wrappers as delivery containers and inspect the decoded child process chain, not just the file that launched it.
Why server-cooperative decryption weakens offline malware analysis
The dropper no longer embeds the payload key material directly. Instead, it generates an ephemeral X25519 keypair, posts the public key and a nonce to the server, and receives a wrapped DEK that only the server can unwrap. That creates a live cryptographic dependency between the sample and the operator infrastructure. Because the server holds the private key and each run uses fresh ephemeral material, captured artefacts are poor candidates for replay or static decryption. This is a practical obstacle to reverse engineering, not just an implementation detail. See the MITRE D3FEND Guide.
Practical implication: Assume sample acquisition alone will not reveal full capability when the malware depends on live key exchange with operator infrastructure.
How the Swift second stage steals macOS credentials and browser data
The second stage is a Swift-based infostealer that uses native macOS and system APIs to capture credentials and data. It validates passwords through PAM, unlocks the login keychain, enumerates keychain items, and uses SQLite backup functions to copy browser databases without corrupting them. It also targets multiple browsers and helper processes, which lets it harvest stored secrets and session-adjacent data at scale. The shift from Rust to Swift does not change the objective; it changes the implementation surface and native feel of the malware. See the macOS Detection and Response Guide.
Practical implication: Watch for legitimate macOS tooling and API calls that are being repurposed to stage credential theft and browser data collection.
Threat narrative
Attacker objective: The attacker wants durable access to macOS credentials and browser-resident secrets that can be collected, staged, and exfiltrated without easy static recovery.
- Entry begins with a fake macOS application installer that delivers a compiled JXA wrapper through a convincing wallet-themed lure.
- Credential access starts when the decrypted Swift stage prompts for authentication, unlocks the login keychain, and copies browser databases and stored secrets.
- Escalation and persistence follow through LaunchAgent registration, shell hook abuse, and global git hooks that can re-trigger the repair script across sessions.
- Impact is the staged collection and exfiltration of keychain material, browser credentials, avatar data, and related archives to operator-controlled infrastructure.
Breaches seen in the wild
- Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Server-cooperative payload delivery is a distinct governance problem, not just a malware trick: When a payload cannot be decrypted without live operator cooperation, defenders lose the assumption that static artefacts are sufficient for full assessment. That changes detection economics because the real control boundary moves from file inspection to runtime observation, infrastructure correlation, and session-aware analysis. The practitioner conclusion is that delivery, decryption, and staging must be treated as one governed chain, not separate events.
Mac malware now abuses native trust paths rather than only custom loaders: This variant relies on AppleScript, zsh, ad hoc signing, LaunchAgents, and user-facing system dialogs to look ordinary at each step. That is not cosmetic; it is a way to inherit legitimacy from default macOS behaviours and reduce the distance between user interaction and credential theft. The practitioner conclusion is that macOS trust signals need to be evaluated as part of identity compromise paths, not only endpoint policy enforcement.
Credential validation has become a theft primitive in macOS stealer tradecraft: The family keeps PAM-based password checking while also extracting keychain and browser data, which means one payload can harvest both user-entered secrets and stored secrets. That broadens the blast radius beyond a single prompt because the malware can chain interactive deception with local secret collection. The practitioner conclusion is that credential prompts, keychain access, and browser harvesters now belong in the same threat model.
Native API abuse is the new normal for commodity infostealers: The move from Rust to Swift does not make the malware more sophisticated in outcome, but it does make it blend more naturally into the platform it targets. The important shift is operational: attackers are using familiar development languages and system frameworks to reduce friction, not to create a new class of exploit. The practitioner conclusion is that defenders should weight behaviour and access paths more heavily than implementation language.
Identity exposure is expanding from passwords to the full local trust stack: The article shows a payload that targets login keychains, browser profiles, helper apps, and background persistence mechanisms in one workflow. That is a reminder that a stolen password is often just the first step in a larger compromise of stored identity artefacts. The practitioner conclusion is that endpoint compromise response needs to extend past user credentials into all locally cached identity material.
Read next: Infostealer Threat Guide
What this signals
Identity compromise on macOS is now multi-layered: One prompt can expose more than a password because the same workflow can reach keychain material, browser databases, helper processes, and persistence hooks. That means programme owners need response logic that joins endpoint telemetry with identity artefact review, not separate playbooks for each layer.
Server-cooperative malware forces a shift from sample-centric to session-centric defence: When decryption depends on live operator infrastructure, the critical evidence sits in the runtime exchange, not just the downloaded file. Defenders should expect more threats to hide their payload behind ephemeral cryptography and treat outbound negotiation as a high-value detection signal.
For practitioners
- Harden the macOS installer boundary Block or scrutinise downloaded .scpt, disk image, and ad hoc signed binaries that chain into shells or interpreters before user trust can be established.
- Instrument runtime decryption workflows Collect telemetry on ephemeral key generation, unusual outbound key-exchange requests, and follow-on decryption utilities that cannot be analysed offline.
- Monitor keychain and browser credential access together Alert when a single process unlocks the login keychain and then enumerates browser databases or helper processes in the same session.
- Review persistence paths beyond LaunchAgents Check shell profile changes, global git hook directories, and repair scripts that can silently re-run after login or repository activity.
Key takeaways
- This variant shows that macOS stealers are now chaining installer deception, runtime decryption, and native APIs to reach identity artefacts with less static visibility.
- The article’s evidence points to a server-dependent payload chain, Swift-based second stage, and persistence paths that extend beyond ordinary LaunchAgents.
- Defenders need to correlate file execution, keychain access, browser theft, and persistence behaviour in one incident view rather than treating them as separate problems.
Related NHI Mgmt Group resources: Infostealer Threat Guide · macOS Detection and Response Guide · Privileged Access Management Guide · Just-in-Time Access and Zero Standing Privilege Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The sample targets keychain and browser-stored secrets as part of its collection chain. |
| NHI-04 — Insecure Authentication | The malware validates passwords and abuses local authentication flows to harvest credentials. | |
| NHI-07 — Long-Lived Secrets | The campaign seeks durable access to stored credentials and keychain material on the host. | |
| Recommendation — Map exposed credential artefacts to NHI-02 and prioritise detection around secret discovery and extraction. Apply NHI-04 controls to flag authentication paths that can be repurposed for credential capture. Use NHI-07 to reduce the lifetime of cached secrets and narrow the value of stolen local credentials. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article describes credential theft and the follow-on use of harvested identity material. |
| Recommendation — Map the chain to TA0006 and TA0008 to prioritise credential theft and movement paths in detection logic. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The malware abuses local access and stored credentials to expand what it can reach on the host. |
| DE.CM-01 — Networks and network services are monitored to detect potential cybersecurity events | The server-cooperative exchange makes outbound monitoring central to detection. | |
| Recommendation — Review entitlements and access paths that allow a single host process to reach keychain and browser secrets. Monitor network sessions for unusual key-exchange traffic and payload negotiation tied to local execution. | ||
Key terms
- Server-cooperative decryption: A malware delivery pattern where the payload cannot be recovered from the sample alone because a live server exchange is required to unwrap the content. This reduces the value of static analysis and shifts defender attention to runtime traffic, ephemeral keys, and operator infrastructure.
- Compiled JXA wrapper: A macOS script container that stores JavaScript for Automation in compiled form and uses it as a delivery layer rather than the final payload. In this pattern, the wrapper exists to hide a shell handoff or decode step, not to perform the main malicious action itself.
- Keychain Abuse: Keychain abuse is the misuse of a password store on macOS to recover saved credentials, tokens, or browser secrets. Once malware can unlock the store, it can turn locally protected authentication material into reusable access without having to defeat each protected service separately.
- Persistence hook: A mechanism that causes malware to run again after login, session start, or routine user activity. Common examples include LaunchAgents, shell profile changes, and global hooks, which let the attacker regain execution without relying on the original installer again.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org