CrashStealer: New macOS Infostealer Poses as Apple Crash Reporter to Steal Wallets and Passwords
Do Son 
At a Glance
| Field | Detail |
|---|---|
| Malware family | CrashStealer (native C++ macOS infostealer) |
| Threat actor | Unattributed; part of a larger multi-platform operation |
| Targets | macOS users, especially cryptocurrency holders |
| Delivery vector | Signed, notarized dropper disk image posing as an installer |
| Key capabilities | Browser, wallet, password-manager and keychain theft; AES-GCM encryption; LaunchAgent persistence |
| Source | Jamf Threat Labs (July 2026) |
TL;DR
Jamf Threat Labs has detailed a new macOS infostealer called CrashStealer. It hides behind a fake Apple crash reporter and steals browser data, crypto wallets, and passwords. A signed, notarized dropper clears Gatekeeper before the payload runs.
What Happened
Jamf first spotted a suspicious sample on VirusTotal in early May. Back then, the macOS infostealer looked unfinished. By early July, the team saw in-the-wild detections, which signaled a shift from development to active use.
CrashStealer stands out from typical Mac stealers. Most rely on AppleScript droppers or thin Objective-C wrappers. This one uses native C++ around an internal class the authors named MacOSData. According to Jamf, it “validates the victim’s login password locally before harvesting” and then collects broadly across the system.
Delivery: A Notarized Dropper
Initial access comes through a disk image posing as an installer. The image presents a polished setup window and asks the victim to open the bundled app. Because the dropper carries a valid Apple Developer ID and a stapled notarization ticket, it clears Gatekeeper on first launch. Jamf reported the abused Developer Team ID to Apple.
The delivery site registered its domain in late June 2026. Downloads sit behind a meeting PIN, so the installer reaches only visitors with the right code. That gating points to a targeted operation rather than a spray campaign.
Infection Chain
The dropper first contacts a trusted developer platform to fetch a small configuration file. That file supplies the next command. This staging on a reputable domain keeps early network activity quiet.
Next, a decoded shell script pulls the payload, a disk image impersonating Apple’s CrashReporter. The script stages the app in a hidden temporary directory, strips its signature, and re-signs it ad-hoc. It then launches the payload in the background. The bundle carries the identifier of a genuine Apple component to blend in.
Data Theft Scope
The payload‘s reach is wide. It targets Chromium-family browsers, roughly 80 cryptocurrency wallet extensions, and 14 password managers. Named targets include MetaMask, Phantom, Coinbase, 1Password, and Bitwarden. The stealer also copies the unlocked login keychain and writes the captured account password to disk.
Command-and-Control and Exfiltration
CrashStealer encrypts stolen files before they leave the host. Each item uses AES-256-GCM through Apple’s CommonCrypto, with keys derived via PBKDF2. As a result, staged loot stays as ciphertext on disk. The malware then packages each category into a hidden ZIP archive.
Exfiltration runs over libcurl to a hardcoded command-and-control server. Earlier samples even stored the C2 address in the app’s property list as a plaintext network exception. Newer builds drop that entry, which suggests the operator moved to a properly configured server. This maturing pattern fits a project moving toward production.
Who Is Behind It
Attribution remains open. Jamf tracks CrashStealer as a distinct family, not a variant of Atomic, MacSync, or Phexia. Researchers have linked shared backend infrastructure and several operator panels to the same campaign. However, no named threat group has been confirmed.
Defense and Detection
Defenders have several durable signals to hunt. Watch for an app bundle launching from a hidden temporary path. Flag a LaunchAgent that impersonates Apple’s crash-reporter component. Hunt for hidden ZIP archives left behind in the stealer’s cache directory, since it fails to delete them.
The delivery chain “shows real care,” Jamf notes, so user vigilance matters. Avoid installers from unfamiliar sites, and never grant Full Disk Access to a surprise “crash reporter.” For the full technical breakdown and indicators, read the Jamf Threat Labs analysis of CrashStealer. Anyone who suspects infection should change passwords from a clean device and revoke active sessions.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
