PamStealer macOS Malware Adds Server-Tied Decryption

Jamf Threat Labs flagged a new PamStealer variant that fetches a server-side decryption utility and completes a key exchange before the payload can be unwrapped, so static recovery fails without live command-and-control. It lures victims via a fake Wavel crypto wallet site, installs four persistence methods, and steals credentials from Chromium and Firefox browsers.