CrashStealer Mac malware steals passwords and wallets

A polished installer tin make risky package consciousness routine. You spot a acquainted Mac window, travel nan directions and participate your password erstwhile asked. By then, nan app whitethorn already beryllium moving against you.

Security researchers astatine Jamf Threat Labs person uncovered CrashStealer, a caller Mac accusation stealer that impersonates Apple's crash-reporting software. Jamf first tracked the malware successful May 2026 while it appeared to beryllium nether development. By early July, researchers detected it successful progressive attacks.

Free unrecorded CyberGuy class: Sick of Spam? Join america July 22

Join america this Wednesday, July 22, astatine 1 PM ET for a free CyberGuy Live people that will thief you cut down connected robocalls, spam texts, junk email and different unwanted messages. Kurt "CyberGuy" Knutsson will locomotion you measurement by measurement done elemental ways to select spam, cleanable up your inbox and admit nan messages that could put your individual accusation astatine risk. No method acquisition is needed. You’ll besides person our spam-stopping checklist, and each registrant will get a nexus to nan people signaling afterward.

Reserve your free spot coming astatine CyberGuyLive.com .

REDHOOK ANDROID MALWARE CAN QUIETLY HIJACK YOUR PHONE

Mac users are being warned astir CrashStealer, a credential-stealing malware that uses clone password prompts and a signed installer to evade suspicion. (Photo by Ute Grabowsky/Photothek via Getty Images)

What is CrashStealer Mac malware?

CrashStealer targets accusation galore group trust connected each day. It searches for browser credentials, password-manager information and cryptocurrency wallet information. The malware tin transcript nan Mac login Keychain arsenic well. The malware stands retired because its developers wrote it successful autochthonal C++. Many communal Mac stealers trust connected AppleScript aliases simpler package wrappers.

CrashStealer besides encrypts nan files it collects earlier sending them to an attacker-controlled server. Meanwhile, anti-debugging features make nan malware harder for researchers to examine. However, nan first app a unfortunate sees isn’t called CrashStealer. The onslaught originates pinch a disk image branded arsenic "Werkbit Setup."

How CrashStealer Mac malware infects computers

The Werkbit Setup disk image contains a polished installer. Its directions show nan personification to right-click nan app and take Open. That action often appears successful instructions for package that needs to get astir a Mac information warning. In this case, nan installer already carried a valid Apple Developer ID and a notarization ticket. Therefore, it could clear Gatekeeper connected its first launch. Jamf besides recovered that nan disk image itself had been signed, which researchers called different for malicious Mac delivery.

The website that distributed Werkbit Setup required a gathering PIN. That setup whitethorn person helped nan attackers limit entree to group who received nan correct code. It besides made nan download consciousness much exclusive and perchance much believable.

Once opened, Werkbit Setup contacted GitHub for an first command. It past downloaded a book from nan attackers' infrastructure. Next, nan book installed a 2nd disk image named CrashReporter.dmg successful a hidden impermanent folder. The payload utilized nan sanction CrashReporter and nan bundle identifier com.apple.crashreporter. Those specifications were chosen to lucifer an Apple system component. The malware past launched softly successful nan background.

How nan malicious Mac installer cleared Gatekeeper

Apple uses Gatekeeper alongside Developer ID signing to trim nan consequence from downloaded software. Its notarization process checks an app for known malicious contented erstwhile developers taxable it. Gatekeeper tin besides cheque whether Apple has revoked nan signing certificate. Still, a notarized explanation should ne'er switch your judgement astir wherever an app came from.

A harmful app tin gaffe done earlier researchers aliases Apple place its behavior. Attackers can besides usage a trusted first-stage installer to retrieve a different payload aft launch. Jamf reported nan Developer Team ID connected to Werkbit Setup to Apple aft confirming that it had distributed malicious software. The study did not opportunity really galore group had been infected.

CrashStealer uses a clone Mac password prompt

After CrashStealer launches, it displays a password punctual designed to lucifer a morganatic macOS authorization request. The malware checks nan password locally pinch a built-in Mac directory work command.

If nan password is wrong, nan punctual returns. If it is correct, CrashStealer stores an obfuscated transcript and uses nan credential to unlock nan login Keychain.

The malware tin past transcript nan Keychain database into its postulation folder. That makes nan punctual 1 of nan astir important informing signs. A password petition tin look convincing, yet nan timing whitethorn consciousness wrong. An online gathering installer should not request your Mac password to show a telephone aliases download mean content.

What information CrashStealer steals from a Mac

CrashStealer searches broadly crossed nan Mac. Jamf recovered codification and activity tied to Chromium-based browsers, Safari information and Firefox credential files. The malware besides checked wallet extensions specified arsenic MetaMask and Phantom. In addition, it targeted password managers that included 1Password, Bitwarden, LastPass and Dashlane. Jamf observed astir 80 cryptocurrency wallet extensions and 14 password managers successful nan target list.

A abstracted file-search instrumentality scans locations specified arsenic Documents and Downloads. However, it skips galore ample installers, apps and media files. That filtering suggests nan thieves want compact files that whitethorn incorporate credentials aliases financial records. Other individual documents whitethorn besides entreaty to nan attackers.

How CrashStealer hides stolen data

CrashStealer stores stolen worldly wrong hidden folders nether nan user's location directory. It encrypts each collected point pinch AES-256-GCM. Then it packages groups of encrypted files into hidden ZIP archives earlier uploading them. Encryption helps nan attackers conceal nan contents of nan stolen files while they beryllium connected nan Mac. It besides intends a leftover archive tin corroborate that postulation occurred moreover erstwhile an interrogator cannot publication nan information wrong it.

The malware past copies itself into nan Mac's Library cache folder. It creates a LaunchAgent that starts nan copied app erstwhile nan personification logs in. The LaunchAgent uses an Apple-like name, which tin make nan introduction blend successful during a speedy inspection.

HALLUSQUATTING AI ATTACK COULD HIJACK YOUR COMPUTER

Security researchers opportunity nan caller CrashStealer malware bypasses users' spot by posing arsenic morganatic Apple package earlier softly harvesting delicate data. (Photo by Jaap Arriens/NurPhoto via Getty Images)

Warning signs of CrashStealer Mac malware

You whitethorn person encountered this run aft downloading Werkbit Setup. The consequence rises if nan website required a gathering PIN. An unexpected CrashReporter password punctual is different reddish flag. Be much suspicious erstwhile nan punctual appears correct aft installing unrelated package aliases joining an online meeting.

Also, watch for an unfamiliar app asking for Full Disk Access aliases support to scope Documents and Downloads. CrashStealer's configuration included support messages designed to make wide record entree sound basal for "system administration." Security teams tin besides look for nan hidden CrashReporter locations and LaunchAgent described successful Jamf's method report. However, astir location users should debar digging done strategy folders unless they cognize precisely what they are changing.

Ways to enactment safe from CrashStealer Mac malware

A fewer careful habits tin thief you spot a suspicious Mac installer earlier it gets entree to your passwords and individual files.

1) Download Mac apps from verified sources

Use nan Mac App Store erstwhile possible. Otherwise, type nan developer's charismatic website reside yourself. Avoid downloading package from a gathering link, backstage connection aliases unexpected pop-up unless you tin independently corroborate nan source.

2) Do not override Mac information warnings automatically

Be wary erstwhile an installer tells you to right-click and take Open aliases usage nan Open Anyway button. Apple recommends overriding a information informing only erstwhile you spot nan app's source. You should besides corroborate that cipher altered nan download.

3) Pause earlier entering your Mac password

Look astatine which app triggered nan punctual and why it needs authorization. Cancel nan petition erstwhile nan logic does not lucifer what you are doing. Then adjacent nan app and verify nan download pinch nan institution done a abstracted channel.

4) Review powerful Mac app permissions and login settings

Open nan Apple paper > System Settings > Privacy & Security . Review Full Disk Access , Files & Folders and Accessibility for apps you do not recognize. Turn disconnected entree for thing suspicious.

Next, unfastened System Settings > General > Login Items & Extensions . Review nan apps listed nether Open astatine Login and Allow successful nan Background . Remove aliases disable unfamiliar entries.

You tin besides cheque System Settings > General > Device Management for profiles you do not recognize. This action whitethorn look only erstwhile a floor plan is installed. Do not region a activity aliases schoolhouse floor plan without contacting nan administrator first.

5) Install nan latest macOS information updates

Open nan Apple paper > System Settings > General > Software Update . Install disposable updates promptly because they see existent information protections.

6) Use beardown antivirus package connected your Mac

A trusted antivirus program tin thief observe known malicious files, suspicious persistence and harmful web behavior. Keep real-time protection enabled and let nan package to update automatically. Jamf says threat-prevention devices tin thief artifact and study akin Mac threats. Get my picks for nan champion 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices astatine Cyberguy.com

7) Act quickly if you installed Werkbit Setup

Disconnect nan Mac from nan internet. Do not participate different password connected that computer. Run a afloat scan pinch trusted information software. You should besides interaction Apple Support aliases your workplace IT team.

Next, usage a cleanable instrumentality to alteration nan password for your Apple Account, superior email relationship and password manager. Change passwords for banking, shopping and different delicate accounts that were saved connected nan affected Mac. Enable two-factor authentication (2FA) wherever disposable and motion retired of devices aliases progressive sessions you do not recognize.

After nan Mac has been cleaned, alteration its login password because CrashStealer whitethorn person captured and validated that credential.

If you usage cryptocurrency wallets connected nan affected Mac, dainty their backstage keys and betterment phrases arsenic exposed. Move remaining costs to recently created wallets from a cleanable device. Never reuse nan aged betterment phrase.

If information package cannot corroborate that CrashStealer has been afloat removed, interaction Apple Support aliases a qualified technician astir erasing nan Mac and reinstalling macOS. Restore individual files cautiously from a backup created earlier nan infection, erstwhile possible.

FBI HELPS TAKE DOWN AI PHISHING RING

A polished Mac installer is disguising a vulnerable caller malware run that steals passwords, browser information and cryptocurrency wallets by impersonating Apple's Crash Reporter. (Photo by Phil Barker/Future Publishing via Getty Images)

Kurt's cardinal takeaways

CrashStealer shows really attackers tin wrap harmful package successful a convincing Mac experience. The signed Werkbit installer gave nan run a furniture of credibility. Then nan clone clang newsman utilized a acquainted password punctual to scope valuable information connected nan computer. Your champion defense originates earlier nan password punctual appears. Verify nan root of each installer and extremity erstwhile nan instructions inquire you to bypass a warning. Strong antivirus protection and existent macOS updates adhd different barrier.

Would Apple notarization gain your trust, aliases would you still mobility a polished Mac installer? Let america cognize by penning to america astatine Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

Get my champion tech tips, urgent information alerts and exclusive deals delivered consecutive to your inbox.

For simple, real-world ways to spot scams early and enactment protected, sojourn CyberGuy.com - trusted by millions who watch CyberGuy connected TV daily.

Plus, you'll get instant entree to my Ultimate Scam Survival Guide free erstwhile you join.

Copyright 2026 CyberGuy.com. All authorities reserved.