Jamf Threat Labs has uncovered CrashStealer, a macOS infostealer that pretends to be Apple’s Crash Reporter and goes after crypto wallets, passwords, browser data, and Keychain secrets.
- Mac-targeted: Built for macOS, not Windows.
- Crypto theft: Targets 80 cryptocurrency wallet extensions.
- Credential grab: Goes after 14 password managers, browser logins, cookies, and Keychain data.
- Trust abuse: Uses a signed and notarized installer to help slip past Gatekeeper.
The name fits. CrashStealer disguises itself as CrashReporter.app, using Apple-style details like the bundle identifier com.apple.crashreporter and a LaunchAgent named com.apple.crashreporter.helper. In plain English, a LaunchAgent is a persistence mechanism, it helps malware keep running in the background after login. Handy for attackers, miserable for everyone else.
According to Jamf, the campaign starts with a first-stage installer called Werkbit Setup, delivered through a fake software site. The download is gated behind a meeting PIN, which suggests the operators wanted to control who got access instead of throwing the payload at everyone and hoping for the best. That kind of distribution is the cybercrime version of a velvet rope.
Once inside a Mac, CrashStealer goes after a broad pile of sensitive data. Jamf says it targets browser credentials and cookies from Chromium-based browsers and Firefox, 80 cryptocurrency wallet extensions, 14 password managers, Keychain data, and files from common folders like Documents and Downloads. That means the damage is not limited to crypto. If a machine is compromised, attackers may also get access to email, cloud accounts, social logins, exchange accounts, and whatever else was saved in the browser or password vault.
For crypto users, the wallet list matters. Jamf’s findings include examples such as MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, Exodus, Keplr, and Solflare. On the password side, the targeted tools include 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm.
That is the part people keep underestimating: an infostealer does not need a cinematic exploit chain if it can just collect the credentials and session data already sitting on a machine. If it gets your browser login, password manager, or wallet extension data, it can walk through the front door wearing your keys.
Jamf also found a fake macOS password prompt built into the malware. If the victim types in a password, the malware checks it locally using dscl -authonly. If the password is correct, it can unlock the user’s login Keychain. That is a big deal because macOS Keychain can store passwords, certificates, private keys, tokens, and other sensitive credentials that users usually forget about until they vanish.
The report says stolen data is encrypted with AES-256-GCM before exfiltration. That is strong encryption, but here it is being used by malware to protect stolen data from defenders, not to protect the victim. In other words, the crook is locking the stolen goods in a better safe.
There’s also a more uncomfortable lesson for the “Macs don’t get malware” crowd: they do. macOS has protections like Gatekeeper and notarization checks, but those safeguards are not magic. Jamf reports that the initial installer was signed and notarized, which can help malware pass Apple’s warnings and look trustworthy enough for a careless click. BleepingComputer, citing Jamf’s findings, said that this lets the installer bypass Gatekeeper without warnings.
That trust abuse is the whole trick. Apple’s security controls can reduce risk, but when attackers borrow Apple’s own credibility, users are left doing security triage with half the lights off. A fake Crash Reporter is exactly the kind of thing someone skimming through alerts might shrug at, right before it starts scavenging credentials.
Jamf’s analysis also shows several signs of a deliberate campaign. The sample uses native C++, local password validation, persistence through a LaunchAgent, and client-side encryption. Jamf noted that earlier samples pointed to a hardcoded command-and-control server through an App Transport Security exception, while later samples removed that exception, suggesting the operators adjusted infrastructure over time. That looks less like a toy sample and more like a maintained operation that learned from the last round.
The crypto risk is straightforward. A hot wallet on a compromised machine is only as safe as the machine itself. Browser extensions, saved sessions, and password-manager vaults can turn a single infection into a wider account takeover chain. For anyone storing meaningful funds on a Mac, that is the ugly part: one sloppy install can become irreversible loss. No chargebacks, no support ticket fairy, no “undo” button.
None of this means every Mac is under siege every minute of the day. It does mean Mac users are an attractive target, especially when they keep valuable credentials and wallet access on the same device they use to browse, chat, trade, and click random downloads.
Key takeaways and questions
-
What did Jamf Threat Labs uncover?
CrashStealer, a macOS infostealer campaign that disguises itself as Apple’s Crash Reporter and steals sensitive user data. -
What does CrashStealer pose as?
It impersonates Apple’s Crash Reporter to look harmless and slip past casual scrutiny. -
What does CrashStealer target?
It targets browser credentials, cookies, Keychain data, 80 cryptocurrency wallet extensions, and 14 password managers. “Target” here means the malware is built to collect data from those apps, not that every one was confirmed stolen from every victim. -
How does it get past Mac protections?
Jamf says the first-stage installer was signed and notarized, which can help it slip past Gatekeeper with fewer warnings. Gatekeeper is Apple’s built-in check that tries to block untrusted apps before they run. -
Why is this especially dangerous for crypto users?
Crypto wallet data, browser sessions, and password-manager vaults can expose exchange logins, seed phrases, and wallet access. Once funds move on-chain, recovery is usually not an option. -
Does this threaten more than crypto wallets?
Yes. If attackers get browser logins, Keychain secrets, or password-manager data, they may also gain access to email, cloud services, social accounts, and banking tools.
The practical defense is boring because good security usually is: use a hardware wallet for serious holdings, keep browser extensions to a minimum, do not store seed phrases in Notes or Downloads, use strong unique passwords, turn on multi-factor authentication, and be suspicious of any installer pretending to be a helpful system utility. If a “crash reporter” wants access to your wallet, your browser, and your password manager, that is not a feature. That is a red flag wearing a name tag.
SHub macOS infostealer variant spoofs Apple security updates
CrashStealer Malware Bypasses macOS Gatekeeper with Signed
