Researchers from Jamf Threat Labs have identified a new variant of the PamStealer macOS malware that implements a server-side decryption chain for its main payload. The malware continues to rely on JavaScript for Automation (JXA) droppers but modifies lure and delivery methods. The decrypted payload enables live command-and-control communication and establishes multi-layer persistence on infected systems. No official patch is available; users are advised to avoid executing unknown scripts from untrusted sources.

What should defenders do?

Users should avoid executing unknown scripts or applications from untrusted sources. Ensure macOS security features such as Gatekeeper and XProtect are enabled and up to date. Monitor for unusual process activity and network connections that may indicate C2 communication. Organizations should educate users about the risks of downloading and running unfamiliar software.

highMalware

New PamStealer macOS Malware Variant Introduces Server-Side Decryption and Multi-Layer Persistence

Jamf Threat Labs identifies updated JXA dropper mechanism targeting macOS users

CyberIntel DeskPublished 4 days agoUpdated less than a minute ago1 min read

New PamStealer macOS Malware Variant Introduces Server-Side Decryption and Multi-Layer Persistence

Key Takeaways

A new variant of PamStealer macOS malware has been identified by Jamf Threat Labs.
The malware uses a server-side decryption chain to recover its main payload, unlike earlier variants that embedded key material locally.
Modified lure and delivery methods via JXA droppers are being used to target macOS users.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read