A newly identified malware strain named CrashStealer is targeting macOS users by disguising itself as Apple's legitimate crash reporting utility. Designed as a C++-based infostealer, the malware is capable of stealing sensitive information, including login credentials, Keychain data, browser passwords, and cryptocurrency wallet information.

According to a research advisory published by Jamf on July 13, CrashStealer first came to light after researchers identified a suspicious sample uploaded to VirusTotal. The researchers believe the malware was under development since May before being deployed in active attacks.

CrashStealer mimics Apple's authentic crash reporting feature, which typically appears after an application crashes unexpectedly. The malware disguises itself using filenames such as CrashReporter.dmg for installation and CrashReporter.app for the application, along with an icon resembling Apple's legitimate software.

One of its notable tactics is displaying a fake macOS authorization prompt to trick users into entering their system password. Once entered, the malware verifies the credentials locally before attempting to extract information from browsers, password managers, Keychain, and cryptocurrency wallets. The stolen information is then encrypted and transmitted to an attacker-controlled server.

The malware is distributed through a disk image packaged as "Werkbit Setup," which contains the malicious CrashReporter installer. Unlike many traditional malware campaigns, the installer carries a valid Apple Developer ID and notarization, allowing it to bypass Apple's Gatekeeper security checks during the initial launch.

The Jamf researchers said, "Because the dropper carries a valid Developer ID and a stapled notarization ticket, it clears Gatekeeper on first launch, in contrast to the ad-hoc-signed payload it installs."

As a result, the installer appears legitimate and may not immediately raise suspicion among users.

Researchers also highlighted other attack techniques increasingly targeting macOS users. One such method is ClickFix, a social engineering technique that convinces users to manually execute malicious commands by presenting fake troubleshooting instructions or CAPTCHA verification prompts.

Artificial intelligence is also emerging as a new distribution channel. Security researchers have observed malware such as Atomic macOS Stealer being spread through manipulated AI chatbot conversations that redirect users to malicious websites hosting malware payloads.

Cybersecurity experts note that macOS is no longer immune to malware threats, with attackers continuing to adopt more sophisticated techniques. The growing use of artificial intelligence in cybercrime is expected to further accelerate the evolution of these attacks.

To reduce the risk of infection, users are advised to download applications only from trusted sources, carefully verify unexpected password prompts, and regularly install macOS and application updates to benefit from the latest security patches.