CrashStealer macOS information stealer activity
Malware Activity
Summary
Hide ▲
Show ▼
CrashStealer is a macOS information-stealing malware that was tracked in May and seen in attacks in early July. It impersonates Apple's crash-reporting tool by using a fake CrashReporter.app name, a com.apple.crashreporter.helper LaunchAgent, and a signed, Apple-notarized installer to help bypass Gatekeeper. The malware collects keychain data, browser credentials, and data from more than 80 crypto wallet extensions and 14 password managers, then encrypts exfiltrated files with AES-256-GCM before uploading them to a C2 server.
Related Happenings
ClickLock Stealer macOS forced-interaction infostealer activity
Malware Activity
H score27
First: 16.07.2026 15:33
Last: 16.07.2026 15:33
Sources 1
About this happening:
ClickLock Stealer is a macOS information-stealing malware that uses a ClickFix-style paste into Terminal and a fake system dialog to coerce users into entering the...
ClickLock Stealer macOS forced-interaction infostealer activity
Malware ActivityAbout this happening: ClickLock Stealer is a macOS information-stealing malware that uses a ClickFix-style paste into Terminal and a fake system dialog to coerce users into entering the...
BoryptGrab infostealer variant delivered via fake GitHub repositories
Malware Activity
H score30
First: 14.07.2026 22:15
Last: 14.07.2026 22:15
Sources 1
About this happening:
A BoryptGrab infostealer variant is being delivered through fake GitHub repositories, expanding a credential-theft operation that can drain browser, wallet, and messaging...
BoryptGrab infostealer variant delivered via fake GitHub repositories
Malware ActivityAbout this happening: A BoryptGrab infostealer variant is being delivered through fake GitHub repositories, expanding a credential-theft operation that can drain browser, wallet, and messaging...
CrashStealer analysis of client-side AES-GCM encryption and anti-analysis techniques
Technical Analysis
H score28
First: 14.07.2026 15:00
Last: 14.07.2026 15:00
Sources 1
How related:
“What sets it apart from the commodity stealer crowd is less what it collects than how it is built: client-side AES-GCM encryption of the collected files, and an emphasis on analysis resistance through control-flow flattening, encrypted strings and layered anti-debugging,”
About this happening:
Researchers published a technical analysis of CrashStealer that adds reusable detail on client-side AES-GCM encryption and layered anti-analysis behavior, making t...
CrashStealer analysis of client-side AES-GCM encryption and anti-analysis techniques
Technical AnalysisHow related: “What sets it apart from the commodity stealer crowd is less what it collects than how it is built: client-side AES-GCM encryption of the collected files, and an emphasis on analysis resistance through control-flow flattening, encrypted strings and layered anti-debugging,”
About this happening: Researchers published a technical analysis of CrashStealer that adds reusable detail on client-side AES-GCM encryption and layered anti-analysis behavior, making t...
CrashStealer meeting-PIN delivery campaign
Campaign
H score35
First: 13.07.2026 22:04
Last: 13.07.2026 22:04
Sources 1
How related:
Downloading the payload is gated behind a meeting PIN, which indicates a campaign limited to visitors who provide the right code.
About this happening:
The CrashStealer campaign is delivering a signed, Apple-notarized installer from a fake software site gated by a meeting PIN, narrowing infection opportunities to...
CrashStealer meeting-PIN delivery campaign
CampaignHow related: Downloading the payload is gated behind a meeting PIN, which indicates a campaign limited to visitors who provide the right code.
About this happening: The CrashStealer campaign is delivering a signed, Apple-notarized installer from a fake software site gated by a meeting PIN, narrowing infection opportunities to...
MacOS.Gaslight AI-analysis evasion malware
Malware Activity
H score22
First: 25.06.2026 19:23
Last: 25.06.2026 19:23
Sources 1
About this happening:
The macOS.Gaslight malware family now embeds prompt injection strings and fake system-failure messages to confuse AI-assisted malware analysis tools, risking aborted o...
MacOS.Gaslight AI-analysis evasion malware
Malware ActivityAbout this happening: The macOS.Gaslight malware family now embeds prompt injection strings and fake system-failure messages to confuse AI-assisted malware analysis tools, risking aborted o...
Timeline
-
13.07.2026 20:36 4 articles · 13d ago
CrashStealer macOS stealer uses a notarized dropper to pass Gatekeeper
Initial DisclosureJamf Threat Labs flagged CrashStealer as a new macOS information stealer implemented in native C++ that is distributed through a signed and Apple-notarized disk image named Werkbit.app, allowing it to pass Gatekeeper checks before staging the payload. The malware validates the victim's login password locally, unlocks the login keychain, collects browser credentials, cryptocurrency wallet data, password manager data, and keychain material, then exfiltrates the stolen archive.
Show sources
- CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks — thehackernews.com — 13.07.2026 20:36
- CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks — thehackernews.com — 13.07.2026 20:36
- New CrashStealer malware poses as Apple crash reporting tool — www.bleepingcomputer.com — 13.07.2026 22:04
- New MacOS Malware Exploits Legitimate Developer ID to Pose as Apple Crash Reporter — www.infosecurity-magazine.com — 14.07.2026 15:00