#ParsedReport #CompletenessHigh
22-09-2026

PamStealer adapts again: a move to Swift with a server-side decryption chain

https://www.jamf.com/blog/pamstealer-wavel-macos-infostealer/

Report completeness: High

Threats:
Pamstealer
Typosquatting_technique
Launchagents_tool

Victims:
Macos users, Cryptocurrency users, Browser users

TTPs:
Tactics: 4
Technics: 0

IOCs:
Url: 10
File: 10
Domain: 2
Hash: 2

Soft:
macOS, curl, Gatekeeper, Google Chrome, Chrome, Microsoft Edge, Chromium, Vivaldi, Opera, Firefox, have more...

Algorithms:
curve25519, base64, zip, aes-gcm, curve25519-donna, sha256, rc4, aes-256-gcm

Functions:
restore_app

Win API:
Arc

Languages:
rust, applescript, objective_c, swift

Platforms:
arm, apple