PamStealer now uses live key exchange to block static payload recovery and is delivered through a fake Wavel macOS download.