CrashStealer Mac malware steals passwords and wallets

A polished installer tin marque risky bundle consciousness routine. You spot a acquainted Mac window, travel the directions and participate your password erstwhile asked. By then, the app whitethorn already beryllium moving against you.

Security researchers astatine Jamf Threat Labs person uncovered CrashStealer, a caller Mac accusation stealer that impersonates Apple's crash-reporting software. Jamf archetypal tracked the malware successful May 2026 portion it appeared to beryllium nether development. By aboriginal July, researchers detected it successful progressive attacks.

Free unrecorded CyberGuy class: Sick of Spam? Join america connected July 22.

Join america this Wednesday, July 22, astatine 1 PM ET for a escaped CyberGuy Live people that volition assistance you chopped down connected robocalls, spam texts, junk email and different unwanted messages. Kurt "CyberGuy" Knutsson volition locomotion you measurement by measurement done elemental ways to filter spam, cleanable up your inbox and admit the messages that could enactment your idiosyncratic accusation astatine risk. No method acquisition is needed. You’ll besides person our spam-stopping checklist, and each registrant volition get a nexus to the people signaling afterward.

Reserve your escaped spot contiguous astatine CyberGuyLive.com.

REDHOOK ANDROID MALWARE CAN QUIETLY HIJACK YOUR PHONE

Mac users are being warned astir CrashStealer, a credential-stealing malware that uses fake password prompts and a signed installer to evade suspicion. (Photo by Ute Grabowsky/Photothek via Getty Images)

What is CrashStealer Mac malware?

CrashStealer targets accusation galore radical trust connected each day. It searches for browser credentials, password-manager information and cryptocurrency wallet information. The malware tin transcript the Mac login Keychain arsenic well. The malware stands retired due to the fact that its developers wrote it successful autochthonal C++. Many communal Mac stealers trust connected AppleScript oregon simpler bundle wrappers.

CrashStealer besides encrypts the files it collects earlier sending them to an attacker-controlled server. Meanwhile, anti-debugging features marque the malware harder for researchers to examine. However, the archetypal app a unfortunate sees isn’t called CrashStealer. The onslaught begins with a disk representation branded arsenic "Werkbit Setup."

How CrashStealer Mac malware infects computers

The Werkbit Setup disk representation contains a polished installer. Its directions archer the idiosyncratic to right-click the app and take Open. That enactment often appears successful instructions for bundle that needs to get astir a Mac information warning. In this case, the installer already carried a valid Apple Developer ID and a notarization ticket. Therefore, it could wide Gatekeeper connected its archetypal launch. Jamf besides recovered that the disk representation itself had been signed, which researchers called antithetic for malicious Mac delivery.

The website that distributed Werkbit Setup required a gathering PIN. That setup whitethorn person helped the attackers bounds entree to radical who received the close code. It besides made the download consciousness much exclusive and perchance much believable.

Once opened, Werkbit Setup contacted GitHub for an archetypal command. It past downloaded a publication from the attackers' infrastructure. Next, the publication installed a 2nd disk representation named CrashReporter.dmg successful a hidden impermanent folder. The payload utilized the sanction CrashReporter and the bundle identifier com.apple.crashreporter. Those details were chosen to lucifer an Apple strategy component. The malware past launched softly successful the background.

How the malicious Mac installer cleared Gatekeeper

Apple uses Gatekeeper alongside Developer ID signing to trim the hazard from downloaded software. Its notarization process checks an app for known malicious contented erstwhile developers taxable it. Gatekeeper tin besides cheque whether Apple has revoked the signing certificate. Still, a notarized statement should ne'er regenerate your judgement astir wherever an app came from.

A harmful app tin gaffe done earlier researchers oregon Apple place its behavior. Attackers tin besides usage a trusted first-stage installer to retrieve a antithetic payload aft launch. Jamf reported the Developer Team ID connected to Werkbit Setup to Apple aft confirming that it had distributed malicious software. The study did not accidental however galore radical had been infected.

CrashStealer uses a fake Mac password prompt

After CrashStealer launches, it displays a password punctual designed to lucifer a morganatic macOS authorization request. The malware checks the password locally with a built-in Mac directory work command.

If the password is wrong, the punctual returns. If it is correct, CrashStealer stores an obfuscated transcript and uses the credential to unlock the login Keychain.

The malware tin past transcript the Keychain database into its postulation folder. That makes the punctual 1 of the astir important informing signs. A password petition tin look convincing, yet the timing whitethorn consciousness wrong. An online gathering installer should not request your Mac password to show a telephone oregon download mean content.

What information CrashStealer steals from a Mac

CrashStealer searches broadly crossed the Mac. Jamf recovered codification and enactment tied to Chromium-based browsers, Safari information and Firefox credential files. The malware besides checked wallet extensions specified arsenic MetaMask and Phantom. In addition, it targeted password managers that included 1Password, Bitwarden, LastPass and Dashlane. Jamf observed astir 80 cryptocurrency wallet extensions and 14 password managers successful the people list.

A abstracted file-search instrumentality scans locations specified arsenic Documents and Downloads. However, it skips galore ample installers, apps and media files. That filtering suggests the thieves privation compact files that whitethorn incorporate credentials oregon fiscal records. Other idiosyncratic documents whitethorn besides entreaty to the attackers.

How CrashStealer hides stolen data

CrashStealer stores stolen worldly wrong hidden folders nether the user's location directory. It encrypts each collected point with AES-256-GCM. Then it packages groups of encrypted files into hidden ZIP archives earlier uploading them. Encryption helps the attackers conceal the contents of the stolen files portion they beryllium connected the Mac. It besides means a leftover archive tin corroborate that postulation occurred adjacent erstwhile an researcher cannot work the information wrong it.

The malware past copies itself into the Mac's Library cache folder. It creates a LaunchAgent that starts the copied app erstwhile the idiosyncratic logs in. The LaunchAgent uses an Apple-like name, which tin marque the introduction blend successful during a speedy inspection.

HALLUSQUATTING AI ATTACK COULD HIJACK YOUR COMPUTER

Security researchers accidental the caller CrashStealer malware bypasses users' spot by posing arsenic morganatic Apple bundle earlier softly harvesting delicate data. (Photo by Jaap Arriens/NurPhoto via Getty Images)

Warning signs of CrashStealer Mac malware

You whitethorn person encountered this run aft downloading Werkbit Setup. The hazard rises if the website requires a gathering PIN. An unexpected CrashReporter password punctual is different reddish flag. Be much suspicious erstwhile the punctual appears close aft installing unrelated bundle oregon joining an online meeting.

Also, ticker for an unfamiliar app asking for Full Disk Access oregon support to scope Documents and Downloads. CrashStealer's configuration included support messages designed to marque wide record entree dependable indispensable for "system administration." Security teams tin besides look for the hidden CrashReporter locations and LaunchAgent described successful Jamf's method report. However, astir location users should debar digging done strategy folders unless they cognize precisely what they are changing.

Ways to enactment harmless from CrashStealer Mac malware

A fewer cautious habits tin assistance you spot a suspicious Mac installer earlier it gets entree to your passwords and idiosyncratic files.

1) Download Mac apps from verified sources

Use the Mac App Store erstwhile possible. Otherwise, benignant the developer's authoritative website code yourself. Avoid downloading bundle from a gathering link, backstage connection oregon unexpected pop-up unless you tin independently corroborate the source.

2) Do not override Mac information warnings automatically

Be wary erstwhile an installer tells you to right-click and take Open oregon usage the Open Anyway button. Apple recommends overriding a information informing lone erstwhile you spot the app's source. You should besides corroborate that cipher altered the download.

3) Pause earlier entering your Mac password

Look astatine which app triggered the punctual and wherefore it needs authorization. Cancel the petition erstwhile the crushed does not lucifer what you are doing. Then adjacent the app and verify the download with the institution done a abstracted channel.

4) Review almighty Mac app permissions and login settings

Open the Apple paper > System Settings > Privacy & Security. Review Full Disk Access, Files & Folders and Accessibility for apps you bash not recognize. Turn disconnected entree for thing suspicious.

Next, unfastened System Settings > General > Login Items & Extensions. Review the apps listed nether Open astatine Login and Allow successful the Background. Remove oregon disable unfamiliar entries.

You tin besides cheque System Settings > General > Device Management for profiles you bash not recognize. This enactment whitethorn look lone erstwhile a illustration is installed. Do not region a enactment oregon schoolhouse illustration without contacting the head first.

5) Install the latest macOS information updates

Open the Apple paper > System Settings > General > Software Update . Install disposable updates promptly due to the fact that they see existent information protections.

6) Use beardown antivirus bundle connected your Mac

A trusted antivirus programme tin assistance observe known malicious files, suspicious persistence and harmful web behavior. Keep real-time extortion enabled and let the bundle to update automatically. Jamf says threat-prevention tools tin assistance artifact and study akin Mac threats. Get my picks for the champion 2026 antivirus extortion winners for your Windows, Mac, Android & iOS devices astatine Cyberguy.com

7) Act rapidly if you installed Werkbit Setup

Disconnect the Mac from the internet. Do not participate different password connected that computer. Run a afloat scan with trusted information software. You should besides interaction Apple Support oregon your workplace IT team.

Next, usage a cleanable instrumentality to alteration the password for your Apple Account, superior email relationship and password manager. Change passwords for banking, buying and different delicate accounts that were saved connected the affected Mac. Enable two-factor authentication (2FA) wherever disposable and motion retired of devices oregon progressive sessions you bash not recognize.

After the Mac has been cleaned, alteration its login password due to the fact that CrashStealer whitethorn person captured and validated that credential.

If you usage cryptocurrency wallets connected the affected Mac, dainty their backstage keys and betterment phrases arsenic exposed. Move remaining funds to recently created wallets from a cleanable device. Never reuse the aged betterment phrase.

If information bundle cannot corroborate that CrashStealer has been afloat removed, interaction Apple Support oregon a qualified technician astir erasing the Mac and reinstalling macOS. Restore idiosyncratic files cautiously from a backup created earlier the infection, erstwhile possible.

FBI HELPS TAKE DOWN AI PHISHING RING

A polished Mac installer is disguising a unsafe caller malware run that steals passwords, browser information and cryptocurrency wallets by impersonating Apple's Crash Reporter. (Photo by Phil Barker/Future Publishing via Getty Images)

Kurt's cardinal takeaways

CrashStealer shows however attackers tin wrapper harmful bundle successful a convincing Mac experience. The signed Werkbit installer gave the run a furniture of credibility. Then the fake clang newsman utilized a acquainted password punctual to scope invaluable information connected the computer. Your champion defence begins earlier the password punctual appears. Verify the root of each installer and halt erstwhile the instructions inquire you to bypass a warning. Strong antivirus extortion and existent macOS updates adhd different barrier.

Would Apple notarization gain your trust, oregon would you inactive question a polished Mac installer? Let america cognize by penning to america astatine Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

Get my champion tech tips, urgent information alerts and exclusive deals delivered consecutive to your inbox.

For simple, real-world ways to spot scams aboriginal and enactment protected, sojourn CyberGuy.com - trusted by millions who ticker CyberGuy connected TV daily.

Plus, you'll get instant entree to my Ultimate Scam Survival Guide escaped erstwhile you join.

Copyright 2026 CyberGuy.com. All rights reserved.