[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ7zwsE4EzvWJYqG6-JxfdWKUV6DV44c74wl8nOVhpLE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"7c33a6a0-5f2c-40dd-a9b4-d3d72f376eae","pamstealer-macos-malware-uses-live-c2-decryption-and-fake-crypto-apps-to-evade-detection","d900ab98-9a74-458f-aa60-45ab4e69002a","PamStealer macOS Malware Uses Live C2 Decryption and Fake Crypto Apps to Evade Detection","PamStealer targets macOS users by disguising itself as a legitimate cryptocurrency wallet service (Wavel), exploiting users' trust in financial tools to gain initial access. Its server-side decryption model means the full malicious payload is never stored locally in decrypted form, making static analysis and traditional antivirus detection significantly harder. The use of multiple persistence mechanisms — including Git hooks — means that even partially successful remediation efforts may leave the attacker with a foothold. This attack underscores the danger of downloading software from unverified sources and the growing sophistication of macOS-targeting threat actors.","**Immediate actions:**\n- Block all outbound connections to unknown or unverified C2 domains using DNS filtering and firewall egress rules.\n- Audit macOS endpoints for suspicious persistence mechanisms including LaunchAgents, LaunchDaemons, login items, and Git hooks in user repositories.\n- Remove or quarantine any unauthorized cryptocurrency wallet applications installed outside of official app stores.\n\n**Long-term improvements:**\n- Enforce an application allowlisting policy so only approved, signed software can execute on macOS endpoints.\n- Implement a mobile device management (MDM) solution to centrally enforce macOS security baselines and monitor configuration drift.\n- Conduct regular security awareness training focused on social engineering tactics, particularly fake financial and cryptocurrency applications.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) tools with macOS support to monitor for anomalous process execution, network beaconing, and persistence modifications.\n- Enable and centralize macOS Unified Logs and ship them to a SIEM for real-time alerting on suspicious LaunchAgent or Git hook creation events.\n- Monitor for live C2 communication patterns such as periodic beaconing, encrypted outbound sessions to newly registered domains, or unusual DNS lookups from user endpoints.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF DE.CM-1: Network Communications Monitoring","MITRE ATT&CK T1543: Create or Modify System Process (Persistence)","MITRE ATT&CK T1546.004: Unix Shell Configuration Modification","MITRE ATT&CK T1071: Application Layer Protocol (C2)","MITRE ATT&CK T1566: Phishing \u002F Social Engineering (Initial Access)",{},"published","2026-09-25T20:22:32.509556+00:00","2026-09-25T20:22:32.419+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fpamstealer-macos-malware-adds-live-c2.html","pamstealer-macos-malware-adds-live-c2-payload-decryption-and-multi-layer-persist-4731c3","PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":41,"name":42,"slug":43,"description":44,"color":45},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":47,"name":48,"slug":49,"description":50,"color":51},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[54,58,62],{"slug":55,"name":56,"problem":57},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":59,"name":60,"problem":61},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":63,"name":64,"problem":65},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]