Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
PamStealer macOS Infostealer Targets Crypto Wallets and Steals User Credentials
Excerpt
A new PamStealer variant is targeting macOS users through a fake cryptocurrency wallet installer. In research published on September 22, Jamf Threat Labs said the malware steals passwords and browser data while using a server-controlled decryption process that makes its payload harder to analyze. The attack begins at wavel[.]app , a site impersonating a multichain crypto wallet. Its macOS download button delivers a disk image containing a compiled .scpt file. Because Finder…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | wavel.app | High | Score 58/100 | First seen |
| Domain | wavel.apple03cloudstore.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…