CrashStealer, a new Mac malware, employs a polished installer and fake prompts to steal sensitive data, including passwords and cryptocurrency wallets, posing a significant threat to users.
Security researchers at Jamf Threat Labs have identified a new Mac information stealer known as CrashStealer, which masquerades as Apple’s crash-reporting software. This malware was first tracked in May 2026 during its development phase, and by early July, it was detected in active attacks.
CrashStealer utilizes a signed Werkbit installer along with a deceptive password prompt to extract sensitive information from users’ devices. The malware targets a variety of data, including browser credentials, password manager information, and cryptocurrency wallet details. Notably, it can also copy the Mac login Keychain, which contains critical user credentials.
What sets CrashStealer apart is its development in native C++, unlike many other Mac stealers that rely on AppleScript or simpler software wrappers. The malware encrypts the files it collects before transmitting them to an attacker-controlled server, complicating efforts to analyze its behavior. Additionally, it incorporates anti-debugging features to hinder researchers from examining its operations.
The initial phase of the attack begins with a disk image labeled “Werkbit Setup.” This polished installer guides users through the installation process, instructing them to right-click the app and select “Open” to bypass Mac security warnings. The installer carries a valid Apple Developer ID and a notarization ticket, allowing it to pass through Gatekeeper on its first launch. Jamf noted that the disk image itself was signed, which is unusual for malicious software delivery on Mac systems.
The website distributing the Werkbit Setup required a meeting PIN, which may have helped attackers limit access to individuals who received the correct code, adding an air of exclusivity and credibility to the download.
Once the Werkbit Setup is executed, it connects to GitHub for initial commands and subsequently downloads a script from the attackers’ infrastructure. This script installs a second disk image named CrashReporter.dmg in a hidden temporary folder. The malware disguises itself as a legitimate Apple system component by using the name CrashReporter and the bundle identifier com.apple.crashreporter.
Apple employs Gatekeeper and Developer ID signing to mitigate risks from downloaded software. Its notarization process checks for known malicious content when developers submit applications. However, users should not rely solely on notarization to determine the safety of an app. Malicious software can slip through before researchers or Apple identify its harmful behavior.
After launching, CrashStealer presents a password prompt that mimics a legitimate macOS authorization request. The malware verifies the password locally using a built-in Mac directory service command. If the password is incorrect, the prompt reappears. If correct, CrashStealer stores an obfuscated copy and uses the credential to unlock the login Keychain, allowing it to copy the Keychain database into its collection folder.
This password prompt is a critical warning sign for users. A legitimate online meeting installer should not require a Mac password to display a call or download ordinary content. CrashStealer scans the Mac extensively, targeting data from Chromium-based browsers, Safari, and Firefox, as well as wallet extensions like MetaMask and Phantom. It also seeks out information from popular password managers, including 1Password, Bitwarden, LastPass, and Dashlane, with approximately 80 cryptocurrency wallet extensions and 14 password managers on its target list.
A separate file-search tool within the malware scans locations such as Documents and Downloads but avoids larger installers, apps, and media files. This filtering indicates that the attackers are primarily interested in compact files that may contain credentials or financial records. Other personal documents may also be of interest to them.
CrashStealer stores the stolen data in hidden folders under the user’s home directory, encrypting each item with AES-256-GCM. The malware packages groups of encrypted files into hidden ZIP archives before uploading them, ensuring that the contents remain concealed while on the infected Mac. This encryption also means that even if investigators find an archive, they cannot read the data inside it.
To maintain persistence, the malware copies itself into the Mac’s Library cache folder and creates a LaunchAgent that initiates the copied app upon user login. The LaunchAgent is given an Apple-like name, allowing it to blend in during a cursory inspection.
Users who downloaded Werkbit Setup may have encountered this campaign. The risk increases if the website required a meeting PIN. An unexpected CrashReporter password prompt is another red flag, particularly if it appears immediately after installing unrelated software or joining an online meeting. Users should be cautious of unfamiliar apps requesting Full Disk Access or permission to access Documents and Downloads.
To protect against such threats, users are advised to utilize the Mac App Store whenever possible. If downloading from other sources, they should manually enter the developer’s official website address. Avoid downloading software from meeting links, private messages, or unexpected pop-ups unless the source can be independently verified.
Users should be wary when an installer prompts them to right-click and choose Open or use the Open Anyway button. Apple recommends overriding a security warning only when the app’s source is trusted. Additionally, users should verify that no alterations were made to the download.
It is essential to scrutinize which app triggered the password prompt and why it requires authorization. If the reason does not align with the user’s current actions, they should cancel the request, close the app, and verify the download through a separate channel.
Regularly reviewing system settings for unfamiliar apps and permissions can help users maintain their security. Keeping macOS updated and using trusted antivirus software can further protect against similar threats.
If a user suspects their Mac has been infected with CrashStealer, they should disconnect from the internet, refrain from entering any passwords, and run a full scan with trusted security software. It is also advisable to contact Apple Support or their workplace IT team for assistance.
After cleaning the Mac, users should change their login password and treat any cryptocurrency wallets on the affected device as compromised. Moving funds to newly created wallets from a clean device is recommended, and old recovery phrases should never be reused.
CrashStealer exemplifies how attackers can disguise harmful software within a seemingly legitimate Mac experience. The signed Werkbit installer adds a layer of credibility, while the fake crash reporter employs a familiar password prompt to access valuable data. Users must remain vigilant and verify the source of every installer to prevent such threats.
For further information, refer to Jamf’s technical report on CrashStealer.