Jamf Threat Labs has identified a new infostealer on macOS called CrashStealer. It passes itself off as Apple’s own CrashReporter process.
According to the researchers, users can get infected through a fake collaboration app called Werkbit. It was delivered in an Apple-notarized installer that got past Apple’s Gatekeeper protections, then showed a fake password prompt that verified the victim’s password locally and opened the macOS Keychain. From there, Jamf Threat Labs says CrashStealer can steal Keychain passwords, browser data, crypto wallets, and other credentials that could be used for account takeovers or direct financial theft.
The researchers also believe this was probably a more targeted campaign than the usual broad malware push. The download was PIN-protected, the malware was written in native C++ rather than the AppleScript-heavy style often seen on macOS, and the stolen data was encrypted with AES-GCM before exfiltration. Jamf says CrashStealer overlaps with Atomic Stealer and MacSync, but it’s being tracked as a separate family for now. Who’s behind it, how many victims there are, which regions were affected, and how the lure was distributed are all still unknown.
If you use a Mac regularly, this one matters. Apple-notarized apps can still conceal serious credential theft. Jamf says the fake Werkbit download was hosted on a convincing site tied to a newly registered domain, though Apple has since revoked the abused developer ID. If you want the full breakdown, Jamf Threat Labs’ macOS report has the details.
Author: Anthony John Padilla
{
"social": {
"email": "content.reviewer90@ext.softonic.com",
"facebook": "",
"twitter": "",
"linkedin": ""
},
"ja-JP": "",
"de-DE": "Anthony Padilla ist ein auf den Philippinen ansässiger Schriftsteller mit Erfahrung in redaktionellen, digitalen und markenorientierten Inhalten. Seine Arbeit konzentriert sich darauf, komplexe Ideen in klare, verständliche Texte umzuwandeln.",
"en-US": "Anthony Padilla is a Philippines-based writer with experience across editorial, digital, and brand-focused content. His work centers on translating complex ideas into clear, accessible copy, with a strong emphasis on structure, accuracy, and user-focused communication. He has contributed to long-form articles, product and platform copy, and marketing-led editorial pieces.",
"es-ES": "Anthony Padilla es un escritor con base en Filipinas con experiencia en contenido editorial, digital y enfocado en marca. Su trabajo se centra en traducir ideas complejas en textos claros y accesibles.",
"fr-FR": "Anthony Padilla est un écrivain basé aux Philippines ayant de l'expérience dans le contenu éditorial, numérique et axé sur la marque. Son travail consiste à traduire des idées complexes en textes clairs et accessibles.",
"it-IT": "Anthony Padilla è uno scrittore con base nelle Filippine con esperienza in contenuti editoriali, digitali e focalizzati sul brand. Il suo lavoro si concentra sulla traduzione di idee complesse in testi chiari e accessibili.",
"nl-NL": "Anthony Padilla is een schrijver gevestigd op de Filipijnen met ervaring in redactionele, digitale en merkgerichte content. Zijn werk richt zich op het vertalen van complexe ideeën naar helder, begrijpelijke teksten.",
"pl-PL": "Anthony Padilla to pisarz mieszkający na Filipinach z doświadczeniem w tworzeniu treści redakcyjnych, cyfrowych i skoncentrowanych na marce. Jego prace skupiają się na przekształcaniu skomplikowanych idei w jasne, zrozumiałe teksty.",
"pt-BR": "Anthony Padilla é um escritor baseado nas Filipinas com experiência em conteúdo editorial, digital e focado em marca. Seu trabalho se concentra em traduzir ideias complexas em textos claros e acessíveis."
}
View all posts by Anthony John Padilla
