First observed in May 2026 and seen in the wild by early July, CrashStealer is a macOS‑specific information‑stealing malware that impersonates Apple’s crash‑reporting component, CrashReporter.app. The binary adopts the exact name, creates a LaunchAgent called com.apple.crashreporter.helper, and mimics the legitimate icon and metadata, thereby evading casual user scrutiny and many security solutions.

Delivery Method and Gatekeeper Evasion

Researchers at Jamf, a provider of Apple device management and security solutions, identified that the payload is delivered via a signed and Apple‑notarized installer named “Werkbit Setup.” Because the installer carries a valid Apple notarization, macOS’s built‑in anti‑malware gatekeeper accepts it without warning, allowing the dropper to slip past the first line of defense.

The initial dropper is hosted on a counterfeit software website that went live in late June. Access to the payload is gated behind a meeting PIN, indicating a targeted campaign limited to users who know the correct code.

Social Engineering and Keychain Theft

When launched, CrashStealer presents a convincing macOS password prompt, masquerading the request as a legitimate system operation that requires administrator privileges. The entered password is locally validated using the dscl command; if incorrect, the malware simply returns an authentication error and asks the user to retry.

Once the correct password is supplied, the malware gains access to the user’s Keychain – macOS’s encrypted vault that stores Safari logins, Wi‑Fi credentials, application passwords, private cryptographic keys, certificates, and tokens.

Data Targets Beyond the Keychain

Jamf’s analysis reveals that CrashStealer also harvests:

• Browser credentials and cookies from Chromium‑based browsers and Firefox.
• More than 80 cryptocurrency wallet extensions, including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, Exodus, Keplr, and Solflare.
• Fourteen password managers such as 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm.
• Files from user directories like Documents and Downloads, while deliberately skipping large media files, installers, and system directories.

Encryption, Packaging, and Exfiltration

Before exfiltrating the stolen data, CrashStealer encrypts it with the robust AES‑256‑GCM algorithm, packages the ciphertext into hidden ZIP archives, and uploads the bundles to a command‑and‑control (C2) server using libcurl. This client‑side encryption distinguishes CrashStealer from other macOS infostealer families such as Atomic, MacSync, and Phexia, which typically rely on weaker or server‑side encryption schemes.

The campaign’s sophistication is further underscored by a self‑re‑signing step that rewrites the binary’s code‑signature metadata, altering its hash without changing the underlying code – a technique designed to maintain persistence while evading static signature‑based detections.

Overall, CrashStealer’s blend of notarized delivery, Apple‑look‑alike deception, and strong encryption marks it as a significant escalation in macOS‑focused threats. Organizations should supplement Gatekeeper with behavior‑based monitoring and robust keychain protection policies to mitigate this emerging risk.