PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Researchers at Jamf Threat Labs flagged a new version of PamStealer macOS malware that adds live C2 payload decryption and multi-layer persistence. The updated variant still uses the same JXA dropper mechanism but modifies the lure and delivery method, making the main payload recoverable only via a server-side decryption chain.