CrashStealer, a native C++ macOS infostealer that disguises itself as Apple\u2019s built-in crash-reporting utility to harvest browser credentials, cryptocurrency wallets, password manager data, and keychain contents before encrypting and exfiltrating everything to a remote command-and-control server.<\/p>\n
Jamf first spotted a suspicious sample on VirusTotal in early May 2026 that appeared to be an infostealer still under construction. By early July, in-the-wild detections confirmed the malware had matured into active deployment, prompting researchers to formally track it as CrashStealer.<\/p>\n
Unlike commodity macOS stealers typically built on AppleScript droppers or thin Objective-C wrappers, CrashStealer is written entirely in native C++ around an internal class called MacOSData, setting it apart from families like Atomic (AMOS)<\/a>, MacSync, and Phexia despite overlapping objectives.<\/p>\n Initial access begins with a disk image named \u201cWerkbit Setup,\u201d containing an application bundle signed with a legitimate Developer ID and a stapled notarization ticket allowing it to clear Gatekeeper on first launch.<\/p>\n This is unusual: even the disk image container itself is signed, a rare touch in malicious DMG campaigns. Once opened, the dropper quietly retrieves an obfuscated shell script from GitHub-hosted infrastructure, decodes multiple layers of Base64-encoded commands, and downloads the actual payload disguised as \u201cCrashReporter.app\u201d complete with Apple\u2019s bundle identifier Once running, CrashStealer validates the victim\u2019s login password locally via This breadth mirrors patterns seen across the modern macOS stealer landscape, where crypto-focused credential theft has become a dominant objective.<\/p>\n What distinguishes CrashStealer technically is its use of client-side AES-256-GCM encryption via Apple\u2019s CommonCrypto framework to encrypt staged data before packaging it into ZIP archives and exfiltrating it over libcurl, a level of operational security not typically seen in commodity AppleScript-based stealers.<\/p>\n This encryption-first approach, paired with anti-analysis measures like control-flow flattening and layered anti-debugging checks, reflects a broader trend of macOS malware families<\/a> professionalizing their tradecraft, a shift researchers across the industry have flagged as macOS threats evolve from opportunistic scripts into structured, business-like operations.<\/p>\n For persistence, CrashStealer copies and re-signs itself ad hoc, then installs a LaunchAgent labeled Jamf also linked the campaign<\/a> to a live operator panel and additional infrastructure domains, suggesting CrashStealer is part of a larger, multi-platform operation rather than an isolated tool.<\/p>\n This discovery adds to a growing body of research showing macOS infostealers rapidly closing the sophistication gap with their Windows counterparts, with detection volumes and technical complexity both climbing sharply through 2025 and into 2026.<\/p>\n \u00a0Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations.\u00a0-> Integrate ANY.RUN With Your SOC <\/a>Now<\/a><\/strong>.<\/strong><\/p>\n The post New macOS Stealer Mimics Apple\u2019s Crash Report Framework to Steal Browser Credentials<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n![\"macOS](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgqWRp74qRcxOOOzQkrxFE2FtKL9DAyqPKPhGY_VKDACo2STKettDdowuC986o5l4CMLlF-EAKh4hpZO8jgET5itZKklvM-AKhTSowUVOUGH0dkm9yz6E6xwlkBPoh8e-SvHxhyjr0a6HOHJ1jzURM_02QM0JhMQCCNN19kRQp7OH7iMJINVhNbwTKIDimD\/w640-h524\/jtl-signed-dropper.webp?ssl=1\")
<\/figure>\n<\/div>\ncom.apple.crashreporter<\/code> and a matching icon.<\/p>\ndscl<\/code>, unlocks the keychain, and profiles installed security tools before beginning collection. Its scope is extensive:<\/p>\n\n
![\"macOS](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi-pIKAOY5KyPbKVJipPbm7XHeW6OhLD2bvOO6Z_k-QJr1uUC1K3tASKck3yE71NTI11ZOnSYngRy5dpAKMidjw8Jy8S2h9p47afMfziW19ucn28iecMMDWDNA79qIBH7SwiNCE4w841feoDpJZ-4nf3Dhvep3K-K_qqlfnkrqfq3FcR1ayTCd-Q1Miijho\/w640-h360\/Crash%2520reporter.webp?ssl=1\")
<\/figure>\ncom.apple.crashreporter.helper<\/code> to survive reboots, continuing the Apple-impersonation theme into its persistence layer.<\/p>\n