Full Report
Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat Labs, continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify the lure and the delivery method. "Where earlier variants embedded their payload key material
Analysis Summary
# Tool/Technique: PamStealer (New Variant)
## Overview
PamStealer is a macOS-centric information stealer designed to exfiltrate sensitive data. Recent variants have evolved to include a sophisticated server-side decryption chain, preventing security researchers from extracting the final payload without an active connection to the attacker's infrastructure. It is primarily delivered via social engineering lures utilizing Apple’s JavaScript for Automation (JXA) framework.
## Technical Details
- **Type:** Malware Family (Infostealer)
- **Platform:** macOS
- **Capabilities:** Credential theft, server-side payload decryption, anti-analysis, persistence via JXA.
- **First Seen:** Initial variants documented in early 2024; server-side decryption variant identified in late 2024.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566 - Phishing
- **TA0002 - Execution**
- T1059.002 - Command and Scripting Interpreter: AppleScript
- **TA0005 - Evasion**
- T1140 - Deobfuscate/Decode Files or Information
- T1027 - Obfuscated Files or Information
- **TA0006 - Credential Access**
- T1555 - Credentials from Password Stores
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols
## Functionality
### Core Capabilities
- **JXA Dropper:** Utilizes Apple’s JavaScript for Automation to execute code within the macOS environment, often bypassing traditional shell-script detections.
- **Credential Harvesting:** Targets system keychains and browser-stored passwords.
- **Data Exfiltration:** Sends harvested data to hardcoded or dynamically retrieved Command and Control (C2) servers.
### Advanced Features
- **Server-Side Decryption Chain:** Unlike previous versions that stored the decryption key locally within the dropper, the new variant requires a multi-stage handshake with a remote server to unlock the final payload. This hinders static analysis and sandboxing.
- **Dynamic Lures:** Modifies lures and delivery methods (often disguised as legitimate software installers or productivity tools) to adapt to current trends.
## Indicators of Compromise
*(Note: Specific hashes and domains vary by campaign; these are based on Jamf Threat Labs findings)*
- **File Hashes:**
- [SHA256: Hash values associated with the JXA dropper artifacts]
- **File Names:**
- `Installer.pkg`
- `Update.js`
- **Network Indicators:**
- `hxxps[:]//api[.]pamstealer[.]com` (Defanged)
- `hxxp[:]//185[.]xxx[.]xxx[.]xxx/payload` (Defanged)
- **Behavioral Indicators:**
- Unexpected execution of `/usr/bin/osascript`.
- Network connections originating from `osascript` to unknown external IPs.
## Associated Threat Actors
- **Unknown:** Currently tracked as a commodity malware family, though typically associated with financially motivated cybercriminals targeting macOS users.
## Detection Methods
- **Signature-based detection:** Scanning for specific JXA code patterns and known malicious AppleScript fragments.
- **Behavioral detection:** Monitoring for `osascript` invoking network requests or accessing `~/Library/Keychains/`.
- **YARA rules:**
- Rule targeting JXA calls: `rule PamStealer_JXA_Dropper { strings: $a = "Application('Standard Additions')" ... }`
## Mitigation Strategies
- **Prevention measures:** Implement Gatekeeper and Notarization requirements strictly. Educate users on the risks of downloading software from non-App Store sources.
- **Hardening recommendations:** Use Endpoint Detection and Response (EDR) tools that specifically monitor macOS AppleScript and JXA execution events. Disable or restrict JXA/AppleScript if not required for business operations.
## Related Tools/Techniques
- **Atomic Stealer (AMOS):** Another prominent macOS stealer using similar delivery lures.
- **Cuckoo Stealer:** Shares functional overlaps in browser data harvesting.
- **JXA Exploitation:** A broader technique used by various macOS-focused malware for living-off-the-land execution.