New 'CrashStealer' Malware Targets Mac Users for Sensitive Data
Security researchers warn of a sophisticated Mac malware campaign that bypasses security measures to steal passwords, cryptocurrency, and other vital information.
A newly identified malware, dubbed CrashStealer, is targeting Mac users by impersonating legitimate Apple software and employing deceptive tactics to steal sensitive data. Security researchers at Jamf Threat Labs first observed the malware in development in May 2026, with active attacks detected by early July.
The malware is designed to steal browser credentials, password manager data, cryptocurrency wallet information, and can also copy the Mac login Keychain. Developers have written CrashStealer in native C++, a departure from many Mac information stealers that use simpler scripting languages. The malware also incorporates anti-debugging features to hinder analysis and encrypts collected files before exfiltration.
Deceptive Installation Tactics
CrashStealer's infection vector begins with a disk image labeled "Werkbit Setup." This installer is polished and uses a familiar Mac interface, instructing users to right-click and open the application, a common method to bypass initial security warnings on macOS. Crucially, the installer was signed with a valid Apple Developer ID and had undergone Apple's notarization process, allowing it to bypass Gatekeeper security on its first launch. Researchers noted that the disk image itself being signed was an unusual characteristic for malicious Mac software distribution.
The distribution website for Werkbit Setup reportedly required a meeting PIN, potentially limiting access to targeted individuals and adding a layer of perceived legitimacy and exclusivity. Upon execution, the "Werkbit Setup" contacted GitHub for initial commands and downloaded a script from the attackers' infrastructure. This script then installed a second disk image, named "CrashReporter.dmg," in a hidden temporary folder. The payload used the name "CrashReporter" and the bundle identifier "com.apple.crashreporter," mimicking a legitimate Apple system component to operate discreetly in the background.
Bypassing Gatekeeper and Evasion
Apple's Gatekeeper, in conjunction with Developer ID signing and notarization, aims to protect users from malicious downloads. However, attackers can exploit the system by using a notarized, signed first-stage installer that retrieves a separate malicious payload after initial execution. Jamf reported the Developer Team ID associated with Werkbit Setup to Apple after its malicious activity was confirmed.
Once active, CrashStealer presents a convincing password prompt designed to mimic macOS authorization requests. The malware locally validates the entered password. If correct, it stores an obfuscated copy of the credential and uses it to unlock the user's login Keychain. This prompt is considered a critical warning sign, especially if it appears unexpectedly after installing new software or joining an online meeting.
Data Targeted by CrashStealer
CrashStealer actively searches for sensitive information across various applications and extensions. Its targets include credential files for Chromium-based browsers, Safari, and Firefox. The malware also specifically targets popular cryptocurrency wallet extensions like MetaMask and Phantom, as well as password managers such as 1Password, Bitwarden, LastPass, and Dashlane. Jamf's analysis identified approximately 80 cryptocurrency wallet extensions and 14 password managers on the malware's target list.
A file-searching tool within CrashStealer scans user directories like Documents and Downloads, filtering out large installers and media files. This suggests a focus on acquiring compact files containing credentials or financial records, though other personal documents may also be collected.
Hiding Stolen Data and Persistence
Collected data is stored in hidden folders within the user's home directory, encrypted using AES-256-GCM, and then packaged into hidden ZIP archives before being uploaded to attacker-controlled servers. This encryption helps conceal the stolen data and confirms collection even if the archives cannot be immediately read. CrashStealer then copies itself to the Mac's Library cache folder and creates a LaunchAgent designed to start the malware automatically upon user login, using an Apple-like name to blend in with legitimate system processes.
Staying Protected
Users can mitigate the risk posed by CrashStealer and similar threats by adopting several security practices. Downloading Mac applications exclusively from verified sources, such as the Mac App Store or directly from developer websites, is crucial. Users should exercise caution and avoid overriding macOS security warnings automatically, only proceeding if the app's source is independently confirmed.
Pausing before entering a Mac password and verifying the reason for the prompt is essential. Unexpected password requests, especially after installing new software or participating in online meetings, should be treated with suspicion. Regularly reviewing application permissions, particularly Full Disk Access, Files & Folders, and Accessibility settings in System Settings, can help identify and revoke unnecessary access for unfamiliar applications.
Additionally, users should regularly check Login Items & Extensions under General settings to remove or disable unknown entries that launch at login or run in the background. Keeping macOS updated with the latest security patches is vital, as these updates often include crucial protections against emerging threats. Employing reputable antivirus software with real-time protection and automatic updates can also help detect and block malicious files and behavior.
In the event of an infection, users are advised to disconnect the Mac from the internet immediately, avoid entering any further passwords, and run a full scan with trusted security software. Changing passwords for critical online accounts, enabling two-factor authentication, and reviewing active sessions are recommended steps. If the malware cannot be fully removed, users may need to consider erasing the Mac and reinstalling macOS, restoring personal files from a pre-infection backup.