Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label CrashStealer. Show all posts
malware
Apple Crash Reporter Apple malware CrashStealer MacOS Malware macOS Security malware

CrashStealer Malware Targets macOS Users by Posing as Apple Crash Reporter

 

A newly identified malware strain named CrashStealer is targeting macOS users by disguising itself as Apple's legitimate crash reporting utility. Designed as a C++-based infostealer, the malware is capable of stealing sensitive information, including login credentials, Keychain data, browser passwords, and cryptocurrency wallet information.

According to a research advisory published by Jamf on July 13, CrashStealer first came to light after researchers identified a suspicious sample uploaded to VirusTotal. The researchers believe the malware was under development since May before being deployed in active attacks.

CrashStealer mimics Apple's authentic crash reporting feature, which typically appears after an application crashes unexpectedly. The malware disguises itself using filenames such as CrashReporter.dmg for installation and CrashReporter.app for the application, along with an icon resembling Apple's legitimate software.

One of its notable tactics is displaying a fake macOS authorization prompt to trick users into entering their system password. Once entered, the malware verifies the credentials locally before attempting to extract information from browsers, password managers, Keychain, and cryptocurrency wallets. The stolen information is then encrypted and transmitted to an attacker-controlled server.

Signed Installer Helps Malware Evade Detection

The malware is distributed through a disk image packaged as "Werkbit Setup," which contains the malicious CrashReporter installer. Unlike many traditional malware campaigns, the installer carries a valid Apple Developer ID and notarization, allowing it to bypass Apple's Gatekeeper security checks during the initial launch.

The Jamf researchers said, "Because the dropper carries a valid Developer ID and a stapled notarization ticket, it clears Gatekeeper on first launch, in contrast to the ad-hoc-signed payload it installs."

As a result, the installer appears legitimate and may not immediately raise suspicion among users.

Researchers also highlighted other attack techniques increasingly targeting macOS users. One such method is ClickFix, a social engineering technique that convinces users to manually execute malicious commands by presenting fake troubleshooting instructions or CAPTCHA verification prompts.

Artificial intelligence is also emerging as a new distribution channel. Security researchers have observed malware such as Atomic macOS Stealer being spread through manipulated AI chatbot conversations that redirect users to malicious websites hosting malware payloads.

Security Experts Recommend Safe Download Practices

Cybersecurity experts note that macOS is no longer immune to malware threats, with attackers continuing to adopt more sophisticated techniques. The growing use of artificial intelligence in cybercrime is expected to further accelerate the evolution of these attacks.

To reduce the risk of infection, users are advised to download applications only from trusted sources, carefully verify unexpected password prompts, and regularly install macOS and application updates to benefit from the latest security patches.
Read more »
Password Manager Security
Apple Gatekeeper Apple Notarized App CrashStealer Cryptocurrency Wallet Theft Cyber Security information stealer Jamf Threat Labs MacOS Malware Password Manager Security

CrashStealer macOS Malware Uses Apple-Notarized App to Evade Security Checks



CrashStealer, a new macOS information-stealing malware named for Apple's Mac operating system, bypasses built-in security protections by using an Apple notarized application, demonstrating a growing trend of malicious actors utilizing legitimate software verification mechanisms in order to target Apple users. 

Jamf Threat Labs researchers discovered that the malware is distributed via a disk image named Werkbit.app that is signed and notarized by Apple. Due to the fact that the installer is notarized by Apple and has a valid developer ID, Gatekeeper security checks can be successfully passed by the installer, increasing user confidence and acceptance of the application.

In early May 2026, Jamf Threat Labs identified CrashStealer as a suspicious macOS sample uploaded to VirusTotal. Activated infections were detected by researchers in early July, indicating the malware had progressed from development to real-world deployment. 

Based on the timeline, the operators seem to have refined the malware before launching broader attacks on macOS. This macOS stealer is written in native C++, unlike many macOS stealers, which rely on AppleScript or Objective-C wrappers. As a result, CrashStealer is more difficult to analyze while ensuring enhanced performance. Researchers have reported that the malware validates the user's macOS login password. 

Once the password has been validated, the malware can unlock the user's login keychain and gain access to additional sensitive information. The attack chain is designed to keep the user's identity hidden. A GitHub repository is utilized by the malware to retrieve configuration data after the victim launches the installer, which is then used to download the final malicious payload. 

GitHub-hosted configurations contain instructions for downloading shell scripts that are responsible for retrieving the final malware payload from attacker-controlled infrastructure when the victim launches the installer. CrashStealer reduces its forensic footprint by decoding its contents during execution rather than storing them in plain text during execution. 

The CrashStealer application establishes persistence as a LaunchAgent, utilizes multiple anti-analysis techniques, and checks for installed security or forensic tools before harvesting data by employing multiple anti-analysis techniques. As a precaution, the malware masquerades as CrashReporter, Apple's legitimate crash reporting utility. 

By using Apple's bundle identifier, icon, and naming conventions, the malware makes malicious activity appear to be similar to legitimate system activity. This malware targets credentials stored in Chromium-based browsers as well as Mozilla Firefox, resulting in a significant increase in browsers affected. MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, Backpack, and MetaMask are among the many cryptocurrency wallet extensions that search for data. 

As part of the attack, CrashStealer attempts to extract information from 14 password managers, including 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm. In addition to collecting files from the user's Documents and Downloads folder, the malware compresses the data into a ZIP archive to reduce the possibility of interception. 

To protect the collected data, it is encrypted using AES-GCM before being transmitted via libcurl to an attacker-controlled server. CrashStealer is noted by researchers as encrypting each file before exfiltration, rather than protecting the entire archive. As a result of its use of industry-standard cryptographic techniques, the malware makes intercepted data significantly more difficult for defenders to analyze without the appropriate key to decrypt. 

Researchers at Jamf observed that the malware incorporates code obfuscation, encrypted strings, control-flow flattening, and layered anti-debugging techniques into its data exfiltration mechanism, making it significantly more resilient than typical information commodity thieves.

Investigators also discovered additional domains and operator infrastructure linked to the campaign, including a password-protected management panel that is believed to be used by the attackers. It has been demonstrated that CrashStealer is not a standalone malware sample, but is part of a coordinated operation. 

Researchers believe CrashStealer exemplifies a growing trend in macOS malware, demonstrating the combination of trusted software signing, multiple stages of delivery, sophisticated anti-analysis techniques, and strong encryption to make it more difficult to detect. Furthermore, the campaign emphasizes the growing tendency of attackers to exploit legitimate Apple security mechanisms for malicious delivery, reinforcing the need for users to verify software sources even when applications pass Gatekeeper checks. 

In CrashStealer, cybercriminals demonstrate the increasing use of trusted security mechanisms to avoid detection and compromise macOS systems by exploiting trusted security mechanisms to evade detection. Increasingly sophisticated methods of delivery and stronger encryption are being adopted by attackers; therefore, organizations and users need to remain vigilant by ensuring that they download software only from trusted sources, monitoring unusual activity, and updating their security solutions.
Read more »
Subscribe to: Posts (Atom)