PamStealer now needs its C2 server to unlock the macOS payload.
The new variant uses an X25519 key exchange, a fake Wavel wallet lure, and redundant persistence, including global Git hooks.
Read:
New Shockwave C2 Aero's more flexible balloon material is designed to enable a more compact rewrap* for repositioning.
*Compared to Shockwave C2+
US Rx only. ISI Link in Bio.