Fake Crypto Wallet App Spreads PamStealer Malware to Steal Mac Passwords

A fake cryptocurrency wallet download is delivering a new version of PamStealer to Mac users. The attack starts with a convincing website whose installer asks visitors to follow instructions.

Running the disguised file starts a hidden chain that can capture the Mac login password and other personal data. This is the third known PamStealer variant.

Rather than simply hiding its harmful program inside the initial download, it relies on a live exchange with an attacker-controlled server to unlock the next stage.

That change makes the payload harder for researchers to examine without the server. Analysts from Jamf Threat Labs identified the new variant after tracking earlier PamStealer activity.

Jamf said in a report shared with Cyber Security News (CSN) that the lure now impersonates a multichain wallet instead of the clipboard tool used in the earlier PamStealer Maccy campaign, while the malware’s password-checking method remains.

In a controlled test, researchers watched the stealer assemble and upload an archive of collected information. The report gives no victim count or financial losses, so the confirmed impact is limited to observed behavior. Still, the mix of password theft, browser collection and lasting access raises serious risks for anyone who runs the installer.

Fake Crypto Wallet App Spreads PamStealer Malware

The wallet-themed site offers what looks like a normal Mac download. Its disk image instead contains a compiled script with an almost invisible name: only its file extension is shown.

Since Finder normally hides extensions, the item may look like an ordinary document until it opens in Script Editor and the user follows the instructions to run it.

That user action matters. Like the fake utility instructions targeting Macs, this attack depends on persuading someone to start the malicious sequence rather than exploiting a software flaw.

Once launched, the script decodes another script and starts it in the background, leaving the visible editor behind while the infection continues.

The background script downloads a small decryption tool and asks the attackers’ server for material needed to unlock an encrypted application.

A fresh exchange happens each time it runs, so investigators cannot simply extract the hidden program from the first download and read it offline. The dropper also removes the downloaded tool’s quarantine flag and applies an ad hoc signature before running it.

After unpacking the payload, the script installs it as a built-in Mac component. It briefly interferes with processes that would normally show a notification about a new background item.

A login task then starts the stealer again at sign-in and checks it repeatedly, while repair mechanisms can restore parts removed by a user or defender.

Password Theft And Staying Power

The main stealer is now written in Swift, replacing the Rust-based component seen in the first version. It displays a familiar-looking Mac password prompt followed by a fake damaged-app warning.

When someone enters a password, the malware checks whether it is correct through the system’s normal login validation mechanism before using it to reach protected information.

The malware can retrieve Keychain items and copy the login keychain database. It also targets credential databases across 17 browsers, including several smaller browsers beyond the usual mainstream choices.

As with other fake Mac installers, the convincing download is only the first step; the real damage follows when private material is gathered and sent away.

Researchers also found collection routines for system details, shell history and the user’s account photo. Per-browser helper applications try to access stored secrets while appearing to be the associated browser.

In the sandbox test, the program packaged its findings and sent the resulting archive to attacker-controlled infrastructure, showing that the theft chain could complete.

Removal may be complicated by a stored backup and repair triggers attached to new shell sessions and Git activity. Mac users should verify downloads and avoid unexpected scripts.

Defenders can set threat and web controls to block and report similar activity, inspect persistence, and reset exposed passwords from a clean device once the Mac is secured.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC