Jamf Threat Labs reported the discovery of a new Mac information stealer named CrashStealer, which masquerades as Apple’s crash-reporting software. The malware was first tracked in May 2026 during its development phase, with active attacks detected by early July 2026.
CrashStealer is designed to gather sensitive information such as browser credentials, password manager data, and cryptocurrency wallet details, including data from the Mac login Keychain. Uniquely, it is coded in native C++, in contrast to many other Mac stealers that utilize AppleScript.
The malware encrypts the files it collects before transmitting them to an attacker-controlled server. To evade detection, it incorporates anti-debugging features, complicating research efforts. The attack is initiated via a disk image labeled “Werkbit Setup.”
This disk image contains a polished installer that instructs users to right-click and select “Open” to bypass a Mac security warning. The installer possesses a valid Apple Developer ID and notarization, allowing it to pass Apple’s Gatekeeper security measures on first launch.
The website distributing Werkbit Setup required users to enter a meeting PIN, potentially to control access to targeted individuals. Upon execution, Werkbit Setup connects to GitHub, downloads a script, and installs a second disk image called CrashReporter.dmg in a hidden temporary folder. The malware uses the name CrashReporter with the bundle identifier com.apple.crashreporter, which mimics Apple system components.
Apple employs Gatekeeper and notarization processes to mitigate risks posed by downloaded applications. However, Jamf warned that harmful applications can bypass detection, especially if they use trusted installers to deliver different payloads afterward. Following the identification of malicious activity, Jamf reported the developer team behind Werkbit Setup to Apple, but details regarding the number of infections remain undisclosed.
After launching, CrashStealer prompts users for a password in a manner that mimics legitimate macOS prompts. The malware locally verifies the entered password and, if correct, can unlock the login Keychain, allowing further data acquisition.
CrashStealer searches through the Mac’s storage for data from Chromium-based browsers, Safari, Firefox, and various cryptocurrency wallet extensions, including MetaMask and Phantom. Targeting over 80 wallet extensions and 14 password managers, it also uses a file-search tool to seek sensitive documents while avoiding larger installers and media files.
Collected data is stored in hidden folders and encrypted using AES-256-GCM before packaging into hidden ZIP archives for uploading. Additionally, CrashStealer installs itself in the Library cache folder and creates a LaunchAgent for persistence during user login.
Users are advised to exercise caution when downloading installers and to scrutinize any password prompts that arise unexpectedly. Recommendations to prevent this malware include utilizing the Mac App Store, thoroughly confirming developer sources, and being cautious with installers requiring explicit user actions.
