CrashStealer macOS Malware Masquerades as Apple Crash Reporter to Steal Credentials

Jul 13, 2026 · Original article ↗

Summary

Jamf researchers describe CrashStealer, a macOS infostealer delivered through a signed, notarized installer. It impersonates CrashReporter.app, targets credentials and wallet data, and encrypts stolen files before sending them to a C2 server.

Key points

Jamf researchers tracked CrashStealer from development in May and observed it in attacks in early July.
Its Werkbit Setup installer is signed and Apple-notarized; the exact initial distribution method is unknown.
CrashStealer impersonates CrashReporter.app and creates a similarly named LaunchAgent.
A fake macOS password prompt seeks access to the user’s Keychain; the malware checks the entered password locally using dscl.
It targets browser credentials and cookies, Keychain data, files in user directories, 14 password managers, and more than 80 cryptocurrency wallet extensions.
Before exfiltration, it encrypts stolen data with AES-256-GCM, packages it in hidden ZIP archives, and uploads it to a C2 server using libcurl.
Jamf researchers say the malware re-signs itself for persistence; they did not disclose the exact distribution method.

Article Details

Attack Vectors: CrashStealer is delivered by a signed and Apple-notarized installer called Werkbit Setup, reportedly hosted on a fake software site; downloading it is gated by a meeting PIN.
The malware impersonates CrashReporter.app, using its name, icon, and metadata, and creates a LaunchAgent named com.apple.crashreporter.helper.
A fake macOS password prompt is used to obtain the user's password, which CrashStealer validates locally with dscl and can use to unlock the user's Keychain.
CrashStealer collects Keychain data, browser credentials and cookies, information from cryptocurrency wallet extensions and password managers, and selected files from user directories.
Before uploading stolen data to its C2 server using libcurl, CrashStealer encrypts it with AES-256-GCM and packages it into hidden ZIP archives.
Defensive Notes: The article reports that the signed and notarized installer can bypass Gatekeeper, so Gatekeeper alone may not prevent this delivery method.
Investigate unexpected CrashReporter.app lookalikes and the LaunchAgent name com.apple.crashreporter.helper.
Treat unexpected macOS password prompts associated with CrashReporter.app as suspicious; the article says CrashStealer uses a fake prompt to obtain credentials.

MITRE ATT&CK

T1005 · Data from Local SystemThe malware collects files from user directories, including Documents and Downloads.T1036.005 · Match Legitimate Resource Name or LocationCrashStealer impersonates CrashReporter.app by using its name, icon, and metadata.T1041 · Exfiltration Over C2 ChannelCrashStealer uploads stolen data to its C2 server.T1056.002 · GUI Input CaptureThe malware displays a fake macOS password prompt to capture the user's password.T1539 · Steal Web Session CookieCrashStealer targets browser cookies for theft.T1547.011 · Plist ModificationCrashStealer creates a LaunchAgent named com.apple.crashreporter.helper for persistence.T1553.001 · Gatekeeper BypassThe signed and notarized Werkbit Setup installer reportedly allows the malware dropper to bypass Gatekeeper.T1555.001 · KeychainCrashStealer obtains the user's password to unlock and steal data from the macOS Keychain.T1555.003 · Credentials from Web BrowsersThe malware targets credentials stored by Chromium-based browsers and Firefox.

Malware

CrashStealerCrashStealer is a new macOS information-stealing malware that disguises itself as Apple’s CrashReporter.app to harvest credentials, Keychain data, and crypto wallet information.

Products

CrashReporter.appCrashStealer is a new macOS information-stealing malware that disguises itself as Apple’s CrashReporter.app to harvest credentials, Keychain data, and crypto wallet information.GatekeeperThis allows it to bypass Gatekeeper, the built-in anti-malware on macOS, without any warnings.KeychainCrashStealer is a new macOS information-stealing malware that disguises itself as Apple’s CrashReporter.app to harvest credentials, Keychain data, and crypto wallet information.macOSCrashStealer is a new macOS information-stealing malware that disguises itself as Apple’s CrashReporter.app to harvest credentials, Keychain data, and crypto wallet information.