A recent discovery by security researchers at Jamf Threat Labs has unveiled a sophisticated new malware targeting Mac users, known as CrashStealer. This information-stealing malware masquerades as Apple’s legitimate crash-reporting software, making it particularly insidious. Jamf first identified the malware in May 2026 during its development phase, and by early July, it was detected in active attacks.
What is CrashStealer Mac malware?
CrashStealer is designed to extract sensitive information that many users rely on daily. It specifically targets browser credentials, password manager data, and cryptocurrency wallet information. Notably, it can also copy the Mac login Keychain. The malware is distinguished by its use of native C++ programming, a departure from many typical Mac stealers that rely on AppleScript or simpler wrappers. Additionally, CrashStealer encrypts the files it collects before transmitting them to an attacker-controlled server, and its anti-debugging features complicate analysis by researchers. The initial point of contact for victims is not the malware itself, but rather a disk image labeled “Werkbit Setup.”
How CrashStealer Mac malware infects computers
The Werkbit Setup disk image features a polished installer that instructs users to right-click the app and select Open, a common tactic used to bypass Mac security warnings. This installer boasts a valid Apple Developer ID and notarization ticket, allowing it to bypass Gatekeeper upon its first launch. Unusually, the disk image itself was also signed, raising eyebrows among researchers. The distribution website for Werkbit Setup required a meeting PIN, which may have created an illusion of exclusivity and trustworthiness.
Once opened, Werkbit Setup connects to GitHub for initial commands and downloads a script from the attackers’ infrastructure. This script installs a second disk image named CrashReporter.dmg in a hidden temporary folder, using a name and bundle identifier that mimic an Apple system component. The malware then quietly launches in the background.
How the malicious Mac installer cleared Gatekeeper
Apple’s Gatekeeper, alongside Developer ID signing, is intended to mitigate risks associated with downloaded software. Its notarization process checks for known malicious content during app submission. However, a notarized label should never replace personal judgment regarding the app’s source. Malicious software can evade detection before researchers or Apple identify its harmful behavior. Attackers can exploit trusted first-stage installers to retrieve different payloads post-launch. Jamf reported the Developer Team ID associated with Werkbit Setup to Apple after confirming its role in distributing malicious software, although the extent of infections remains unspecified.
CrashStealer uses a fake Mac password prompt
Upon launching, CrashStealer presents a password prompt designed to resemble a legitimate macOS authorization request. The malware verifies the entered password locally using a built-in Mac directory service command. If the password is incorrect, the prompt reappears; if correct, CrashStealer stores an obfuscated copy and uses the credential to unlock the login Keychain. This allows it to copy the Keychain database into its collection folder, making the password prompt a critical warning sign. Users should be cautious if a password request appears unexpectedly, especially following unrelated software installations or online meetings.
What data CrashStealer steals from a Mac
CrashStealer conducts a broad search across the Mac, targeting data linked to Chromium-based browsers, Safari, and Firefox credential files. It also scans for wallet extensions like MetaMask and Phantom, as well as password managers such as 1Password, Bitwarden, LastPass, and Dashlane. Jamf identified approximately 80 cryptocurrency wallet extensions and 14 password managers among its targets. A separate file-search tool scans locations like Documents and Downloads while avoiding larger installers, apps, and media files, indicating that the attackers are primarily interested in compact files containing credentials or financial records.
How CrashStealer hides stolen data
Stolen data is stored in hidden folders within the user’s home directory, where it is encrypted using AES-256-GCM. The malware then packages groups of encrypted files into hidden ZIP archives before uploading them. This encryption conceals the contents of the stolen files while they reside on the Mac, and even if an archive remains, it can confirm that data collection occurred, even if the data itself cannot be read. Furthermore, the malware replicates itself in the Mac’s Library cache folder and creates a LaunchAgent to ensure the copied app runs upon user login, using an Apple-like name to blend in during quick inspections.
Warning signs of CrashStealer Mac malware
Users who have downloaded Werkbit Setup should be particularly vigilant. Signs of potential infection include:
- A website requiring a meeting PIN for download.
- An unexpected CrashReporter password prompt, especially after installing unrelated software or joining an online meeting.
- An unfamiliar app requesting Full Disk Access or permission to access Documents and Downloads.
CrashStealer’s configuration included permission messages that made broad file access seem necessary for “system administration.” Security teams can investigate hidden CrashReporter locations and LaunchAgents as described in Jamf’s technical report, although most home users should refrain from exploring system folders without expertise.
Ways to stay safe from CrashStealer Mac malware
Adopting certain habits can help users identify suspicious Mac installers before they compromise passwords and personal files:
1) Download Mac apps from verified sources
Whenever possible, utilize the Mac App Store. If downloading from elsewhere, manually enter the developer’s official website address. Avoid software obtained through meeting links, private messages, or unexpected pop-ups unless the source is independently verified.
2) Do not override Mac security warnings automatically
Exercise caution when prompted to right-click and choose Open or use the Open Anyway button. Apple recommends overriding security warnings only when the app’s source is trusted. Confirm that the download remains unaltered.
3) Pause before entering your Mac password
Evaluate which app triggered the prompt and its justification for requiring authorization. Cancel the request if the reason seems incongruous with your current activity. Close the app and verify the download through a separate channel.
4) Review powerful Mac app permissions and login settings
Navigate to the Apple menu > System Settings > Privacy & Security to scrutinize Full Disk Access, Files & Folders, and Accessibility for unfamiliar apps. Disable access for anything suspicious. Additionally, check System Settings > General > Login Items & Extensions for apps set to open at login and remove or disable any that are unrecognized.
5) Install the latest macOS security updates
Regularly check for updates under the Apple menu > System Settings > General > Software Update and install them promptly, as they contain essential security protections.
6) Use strong antivirus software on your Mac
A reputable antivirus program can help detect known malicious files, suspicious persistence, and harmful network behavior. Ensure real-time protection is enabled and allow automatic updates. Jamf suggests that threat-prevention tools can block and report similar Mac threats.
7) Act quickly if you installed Werkbit Setup
Immediately disconnect the Mac from the internet and refrain from entering any further passwords on that device. Conduct a full scan with trusted security software and reach out to Apple Support or your workplace IT team. Use a clean device to change passwords for your Apple Account, primary email account, and password manager. Enable two-factor authentication (2FA) where possible and sign out of any unrecognized devices or active sessions. After cleaning the Mac, change its login password, as CrashStealer may have captured it. If you utilize cryptocurrency wallets on the affected Mac, treat their private keys and recovery phrases as compromised, moving funds to newly created wallets from a secure device.
If security software cannot confirm that CrashStealer has been fully eradicated, consider contacting Apple Support or a qualified technician to erase the Mac and reinstall macOS, restoring personal files cautiously from a backup created prior to the infection.
