-
New infostealer malware CrashStealer poses as a legit Apple crash reporting tool to bypass macOS security.
-
It is capable of stealing passwords, credentials, and keychain information from nearly 80 crypto wallets.
-
CrashStealer validates a victim’s password locally before accessing the Keychain and encrypting the stolen information using AES-256-GCM encryption method.
Security experts discovered a sophisticated threat called “CrashStealer” that targets Mac users. The malware fools users into giving out their passwords and other personal details.
This malicious software works by pretending to be an Apple system component to access confidential information from the users’ computers.
How CrashStealer Gets Past Apple’s Defenses
At first, in May 2026, researchers from Jamf spotted a file scanned in VirusTotal that caught their interest. At that time, it seemed that the malware was still developing. But by July, the researchers saw it was already appearing as a tool in many attacks.
The attack starts with a disk image called “Werkbit Setup.” It makes use of an installer with an authorized Apple Developer ID certificate and a notarization ticket. This enables it to get past the macOS security detection system, Gatekeeper, without triggering alarms.
The domain serving the installer, werkbit.io, was registered in late June this year. The ability to bypass Gatekeeper reflects a broader trend of sophisticated phishing malware evading macOS privacy controls. Access is gated behind a meeting PIN. This means the malware only infects visitors who have the right code.
Once launched, the dropper reaches out to a GitHub repository. It fetches a shell script that downloads the actual payload, a file named CrashReporter.dmg. The script is delivered in multiple Base64-encoded layers, making analysis harder.
A Masterclass in Deception
This payload pretends to be Apple’s crash reporting tool. It adopts the name “CrashReporter.app.” The malware also grabs Apple’s bundle identifier. It uses com.apple.crashreporter to look official.
Then it sets up a LaunchAgent called com.apple.crashreporter.helper. This keeps the malware running in the background. To really sell the act, it grabs the real app icon and metadata, so at first glance, it looks totally legit.
When launched, the malware displays a fake macOS password prompt. This convinces users they are authorizing a legitimate system operation. The malware validates the entered password locally using ‘dscl’ (Directory Service command-line). If it’s incorrect, it returns an authentication error and asks again.
A correct password unlocks the user’s Keychain, an encrypted macOS password vault. It typically contains Safari logins, Wi-Fi passwords, application passwords, and private cryptographic keys.
What Data Does CrashStealer Target?
CrashStealer’s data collection is extensive. It targets browser credentials and cookies from Chromium-based browsers and Firefox. CrashStealer doesn’t stop at browsers. It goes after 80 crypto wallet extensions. MetaMask, Phantom, and Coinbase Wallet are among the targets. So are Trust Wallet, Rabby, Exodus, and Keplr.
Password managers, about 14 of them, are also on the list of CrashStealer’s target. That includes 1Password, Bitwarden, Keeper, KeePassXC, LastPass, Dashlane, NordPass, and others. It intentionally skips large media files to avoid detection.
Before sending out any data it collected, CrashStealer locks it down. It uses AES-256-GCM encryption. That’s unusually strong an infostealer. Then it packages the data into hidden ZIP archives. After that, it uses libcurl to send the compressed files over to its C2 server.
According to the researchers, CrashStealer stands out from other infostealers out there. This is due to its client-side encryption mechanism and its native C++ implementation. Most macOS stealers are built on AppleScript droppers. This particular one is implemented in compiled C++.
A Larger Campaign
Jamf identified shared backend infrastructure and additional domains tied to the same operation. This suggests CrashStealer is part of a larger, multi-platform campaign. Researchers also found evidence of a companion Windows variant.
The “re-signing process” is another clever technique CrashStealer uses to evade detection. It gives a new hash value to the binary file while the code stays the same. That tricks hash-based security tools, letting CrashStealer slide right past them.
Apple caught wind of this and revoked the developer credentials used to sign this malware. As a result, notarized droppers can no longer run on later macOS versions. However, the campaign demonstrates how attackers are getting better at sneaking past security gates.
Users should be wary of unexpected password prompts. Also, steer clear of downloading software from any unknown source. If you unknowingly entered your password anywhere suspicious, change it to a new one from a clean device immediately.
