This macOS stealer can't be reverse engineered offline - the C2 server has to unlock its own payload. https://intel.threadlinqs.com/threat/TL-2026-2674 #ThreatIntel #PamStealer #Wavel #pkgunpack

PamStealer returns on macOS with live C2 decryption, a fake Wavel wallet lure, and multi-layer persistence to steal passwords, keychain items, browser creds, and system data. #PamStealer #Wavel #macOS