Security researchers at Jamf Threat Labs have identified a new macOS information stealer called CrashStealer that is capable of harvesting sensitive data from compromised systems. The malware uses a notarized dropper to pass Apple’s Gatekeeper security checks before deploying its payload.
Unlike many other information stealers that rely on AppleScript droppers or Objective-C wrappers, CrashStealer is implemented in native C++, making it more difficult to detect and analyse. The malware validates the victim’s login password locally before proceeding with data theft, ensuring that it only activates on systems where it can capture meaningful credentials.
The malware masquerades as Apple’s Crash Reporter tool, displaying a fake error dialogue to trick users into entering their system password. Once the password is obtained, CrashStealer can access a wide range of sensitive data including browser credentials, cryptocurrency wallets, password manager databases, and personal files.
The fact that the dropper was notarized by Apple means it initially passed the company’s automated security scanning, allowing it to be distributed through channels that would normally block unsigned or unnotarized software. Apple has since revoked the notarization, but users who downloaded the software before the revocation remain at risk.
Researchers advise Mac users to avoid downloading software from untrusted sources, to verify that applications are from legitimate developers, and to never enter system passwords in response to unexpected dialogues that appear outside the normal login process.
