Summary:

A recently discovered macOS information-stealing malware called CrashStealer exploits Apple's trusted code-signing and notarization process to bypass Gatekeeper and appear legitimate. It masquerades as the native CrashReporter.app and uses fake authentication prompts to obtain users' macOS passwords, unlock the Keychain, and steal browser credentials, cookies, password manager data, cryptocurrency wallet information, and selected user files. The malware establishes persistence using a malicious LaunchAgent, employs anti-analysis techniques, encrypts stolen data locally using AES-256-GCM before exfiltration, and uses libcurl to communicate with attacker-controlled infrastructure. Its use of a notarized installer, native C++ implementation, client-side encryption, and stealth-focused persistence distinguishes it from many other macOS infostealers currently in use, making it a significant threat to both enterprise and individual Apple users.

Technical Description:

CrashStealer is a macOS information-stealing malware distributed through a signed and Apple-notarized installer, allowing it to bypass Gatekeeper and increase the likelihood of successful execution. By impersonating CrashReporter.app and establishing persistence through a LaunchAgent, the malware is designed to appear as a legitimate Apple component. To reduce detection and hinder forensic analysis, it also employs a variety of evasion techniques, including code obfuscation, self-re-signing, and anti-analysis capabilities.

Before accessing the macOS Keychain and collecting sensitive information from web browsers, password managers, cryptocurrency wallet extensions, and selected user directories, CrashStealer first validates the victim's credentials locally. The collected data is encrypted using AES-256-GCM on the endpoint, stored, and transmitted over encrypted network connections to attacker-controlled infrastructure. CrashStealer is a notable addition to the evolving macOS malware landscape due to its combination of trusted code signing, stealth techniques, and extensive credential theft capabilities. The technical details of the attack campaign are discussed further below.

Delivery and Infection Chain:

CrashStealer is distributed through a signed and Apple-notarized installer hosted on a fraudulent software website. The installer uses a legitimate Apple Developer ID and notarization to bypass macOS Gatekeeper while masquerading as a legitimate application. Access to the download requires a meeting PIN, indicating a targeted or controlled distribution model rather than a random mass distribution.

The infection chain was identified as follows:

• The victim downloads and executes a signed and Apple-notarized installer from a fraudulent software distribution website, allowing it to bypass macOS Gatekeeper without triggering security warnings.
• The installer retrieves and deploys the CrashStealer payload from attacker-controlled infrastructure, disguising it as the legitimate CrashReporter.app to evade user suspicion.
• The malware establishes persistence by creating a LaunchAgent and displays a fake macOS authentication prompt to capture and locally validate the user's login password.
• Using the validated credentials, CrashStealer unlocks the macOS Keychain and harvests sensitive data, including browser credentials, password manager data, cryptocurrency wallet information, and selected user files.
• The collected data is encrypted using AES-256-GCM, compressed into hidden archives, and exfiltrated to the attacker's command-and-control (C2) server over encrypted network communications.

Technical Capabilities:

CrashStealer is distributed via a signed, Apple-notarized installer hosted on a fraudulent software website. The installer uses a legitimate Apple Developer ID and notarization to bypass macOS Gatekeeper while masquerading as a legitimate application. Access to the download requires a meeting PIN, indicating a targeted or controlled distribution model rather than a random mass distribution.

The infection chain was identified as follows:

• The victim downloads and executes a signed and Apple-notarized installer from a fraudulent software distribution website, allowing it to bypass macOS Gatekeeper without triggering security warnings.
• The installer retrieves and deploys the CrashStealer payload from attacker-controlled infrastructure, disguising it as the legitimate CrashReporter.app to evade user suspicion.
• The malware establishes persistence by creating a LaunchAgent and displays a fake macOS authentication prompt to capture and locally validate the user's login password.
• Using the validated credentials, CrashStealer unlocks the macOS Keychain and harvests sensitive data, including browser credentials, password manager data, cryptocurrency wallet information, and selected user files.
• The collected data is encrypted using AES-256-GCM, compressed into hidden archives, and exfiltrated to the attacker's command-and-control (C2) server over encrypted network communications.

Attribution and Evolution:

At the time of analysis, no threat actor has been publicly attributed to the CrashStealer campaign. Researchers first observed development activity in May 2026, with active attacks beginning in early July 2026. The malware demonstrates a higher level of operational maturity than many commodity macOS stealers through its use of notarized delivery, native C++ implementation, client-side encryption, and advanced persistence techniques, indicating continued evolution within the macOS malware ecosystem.

Active Campaign and Geographic Spread:

Current evidence indicates that CrashStealer is being distributed as part of a targeted campaign rather than a widespread opportunistic operation. The use of meeting PIN-protected downloads, fake software distribution websites, and shared backend infrastructure suggests a carefully controlled deployment strategy. At present, no specific geographic region has been identified as the primary target, and the campaign appears capable of targeting macOS users globally.

Conclusion:

CrashStealer represents an evolution in macOS information-stealing malware by combining trusted code-signing abuse, sophisticated evasion techniques, and comprehensive credential theft capabilities. Its ability to evade initial security controls, impersonate legitimate Apple components, and securely exfiltrate sensitive data highlights the need for layered endpoint security, continuous monitoring, and user awareness. Organizations should monitor for indicators of compromise, strengthen endpoint detection capabilities, and verify the legitimacy of software sources to reduce the risk of infection.

Impact:

Successful infection may result in the compromise of user credentials, browser sessions, password vaults, cryptocurrency wallets, cryptographic keys, and sensitive documents. The theft of authentication material can enable account takeover, financial fraud, unauthorized access to enterprise environments, and follow-on attacks. Because the malware bypasses common macOS trust mechanisms and focuses on credential theft, it presents a significant risk to both individual users and enterprise organizations.

IOC and Context Details:

Recommended Actions:

• Download and install macOS applications only from trusted sources, such as the official developer website or the App Store, and verify the legitimacy of software before execution.
• Deploy endpoint detection and response (EDR) solutions capable of monitoring suspicious LaunchAgent creation, fake authentication prompts, credential access, and abnormal process behavior.
• Enable multi-factor authentication (MFA) for enterprise and personal accounts to reduce the risk of account compromise if credentials are stolen.
• Monitor macOS endpoints for unauthorized persistence mechanisms, unexpected code-signing changes, and unusual access to the Keychain, browsers, and password manager databases.
• Restrict administrative privileges using the principle of least privilege and educate users to verify unexpected macOS authentication prompts before entering their credentials.
• Continuously update macOS, web browsers, and security software to ensure the latest security protections and threat intelligence are applied.
• Implement network monitoring to detect suspicious outbound connections, particularly communications to unknown or untrusted command-and-control (C2) infrastructure.
• Regularly review indicators of compromise (IOCs) published by security vendors and incorporate them into security monitoring, threat hunting, and incident response processes.

Reference:

https://thehackernews.com/2026/07/crashstealer-macos-malware-uses.html