New Version of PamStealer Malware Discovered

Cybersecurity researchers have identified a new version of the PamStealer malware, which exhibits significant changes in the way the main payload is decrypted. According to reports from Jamf Threat Labs, the payload can now only be restored through a server-side decryption chain. This development poses a substantial challenge for security measures, as the malware is now harder to detect and neutralize. The current variant continues to utilize the proven JavaScript for Automation (JXA) dropper mechanism but has modified its distribution methods and lure offerings. Previous versions of the malware used direct embedding of their payload key materials, which made detection easier.

The new techniques aim to bypass detection by security software. A key feature of the new PamStealer version is its multi-layer persistence, which allows the malware to remain active even after a system restart. This persistence is achieved through various techniques designed to anchor the malware within the system and complicate its removal. Security researchers warn that this type of persistence poses a serious threat to the integrity of macOS systems. The malware aims to steal sensitive information from affected devices, including passwords, credit card information, and other personal data.

The use of server-side decryption means that attackers have control over the decryption process, complicating the traceability and analysis of the malware. This could lead to an increase in cyberattacks targeting macOS users. The security community has already taken steps to monitor the spread of the new PamStealer variant. Companies and individuals are strongly advised to review their security protocols and ensure that their systems are up to date. Implementing multi-layered security solutions could help mitigate the risks associated with this type of malware.

In addition to the technical changes, the new version of PamStealer has also adjusted its distribution methods. The malware is now spread through targeted phishing campaigns aimed at tricking users into downloading malicious software. This tactic increases the likelihood that unsuspecting users will unknowingly install the malware. The discovery of this new malware variant comes at a time when cybersecurity threats to macOS users are on the rise. Experts warn that the combination of advanced techniques and the increasing spread of malware could pose a serious challenge to IT security.

Security authorities are working to analyze the threat and develop appropriate countermeasures. The exact number of affected systems is currently unknown; however, it is estimated that the spread of the malware could increase in the coming weeks. Security researchers recommend regularly performing security updates and monitoring for suspicious activities on devices. The malware could spread rapidly if no appropriate measures are taken. The vulnerability exploited by the new PamStealer version could have significant implications for user privacy and security.

Experts advise remaining vigilant and taking all necessary steps to protect personal data. The malware is an example of the ever-evolving threats in the field of cybersecurity. Researchers from Jamf Threat Labs have already taken initial steps to analyze the malware and understand its functionality. Insights from this analysis are expected to be published in the coming weeks to inform the security community about the latest developments. The new version of PamStealer was first discovered on September 28, 2026, and has since caused a stir in the cybersecurity community.