Disguised as Apple’s CrashReporter, a new macOS app steals passwords, browser data, crypto wallets, and other sensitive information — then encrypts the loot before shipping it to attackers.
Jamf Threat Labs named the family CrashStealer (July 13, 2026). BleepingComputer, MacRumors, and Help Net Security covered the same research.
This is not a duplicate of our ClickLock Stealer post — ClickLock is a ClickFix / screen-freeze campaign (Group-IB). CrashStealer is a native C++ stealer that impersonates CrashReporter behind a notarized “Werkbit” dropper.
Snapshot
| Field | Detail |
|---|---|
| Malware | CrashStealer (Jamf Threat Labs) |
| Platform | macOS (native C++; internal class MacOSData) |
| First VT sample | Early May 2026 (looked like development) |
| In-the-wild | Early July 2026 detections matching Jamf rules |
| Dropper | Signed + Apple-notarized Werkbit Setup DMG (Werkbit.app / veltod) |
| Payload lookalike | CrashReporter.app (com.apple.crashreporter) |
| Password trick | Fake macOS auth prompt; validates with dscl -authonly |
| Persistence | LaunchAgent com.apple.crashreporter.helper under ~/Library/LaunchAgents/ |
| Exfil | AES-256-GCM encrypted .cache files → .zx_*.zip → libcurl to C2 |
How the attack works
- Notarized dropper — Victim opens a polished Werkbit Setup disk image. Because it carries a valid Developer ID and stapled notarization, it can clear Gatekeeper on first launch.
- Quiet fetch — The dropper reaches GitHub, then attacker infra, downloads
CrashReporter.dmg, stagesCrashReporter.appunder a hidden path like/private/tmp/.CrashReporter/, strips/re-signs ad-hoc, and launches it. - Fake system utility — The payload uses CrashReporter’s name, icon, and bundle ID. Apple’s real crash reporting is already built into macOS — a separate “CrashReporter” download is a red flag.
- Password prompt — A native-looking dialog asks for the Mac login password “for system administration.” Wrong passwords re-prompt; a correct one unlocks the login Keychain.
- Harvest + encrypt — Browsers, ~80 wallet extensions, 14 password managers, Keychain, and curated Documents/Downloads files are staged under
~/.cache/com.apple.crashreporter/, encrypted, zipped, and uploaded. - Stay resident — A re-signed copy at
~/Library/Caches/com.apple.crashreporter/CrashReporter.appplus the fake Apple LaunchAgent relaunches at login.
What gets stolen
| Category | Jamf observations |
|---|---|
| System secrets | Login Keychain (login.keychain-db), validated Mac password |
| Browsers | Chromium-family profiles + Firefox logins / extension data |
| Crypto | ~80 wallet extensions (MetaMask, Phantom, Coinbase, Trust, Exodus, and more) |
| Password managers | 14 extensions (1Password, Bitwarden, LastPass, Dashlane, Keeper, etc.) |
| Files | Curated Documents / Downloads (skips bulky media, installers, system dirs) |
Jamf notes Apple revoked the malicious Developer Team credentials after disclosure — that specific Werkbit vector is disrupted, but the CrashReporter impersonation pattern can return with new signing identities.
What Mac users should do
- Never install an app named CrashReporter — Apple’s crash reporting is built in.
- Treat unexpected notarized “meeting / setup” DMGs with PIN gates as high risk.
- Do not type your Mac password into prompts from unknown apps — Force quit / shut down instead.
- Hunt
~/Library/LaunchAgents/com.apple.crashreporter.helper.plistand hidden dirs under~/.cache/com.apple.crashreporter/(including leftover.zx_*.ziparchives). - If you entered the password: change critical credentials from a clean device, revoke sessions, rotate crypto wallets, and reimage when in doubt.
- Keep macOS updated; use reputable endpoint protection that blocks notarized malware abuse.
Why Texas businesses should care
Texas firms often put client work, Microsoft 365, banking, and crypto / payment tools on Macs. A notarized installer that looks like a meeting app can clear Gatekeeper, then a fake CrashReporter can empty browsers, vault extensions, and Keychain — fuel for later BEC and wire fraud of the kind we track in Texas OAG breach reports.
Same trust-abuse class as ClickLock and WhatsApp fake-document RMM malware: the user runs the dangerous step under a familiar Apple-looking brand.
Independent cybersecurity audits
We audited domains tied to this story on July 24, 2026. 100% is the ideal overall score — none of these hosts reach it. Scores reflect public email / transport / website posture, not whether CrashReporter.app is safe to run.
| Organization | Domain | Overall | Identity | Transport | Website | vs 100% ideal |
|---|---|---|---|---|---|---|
| Cloudflare | cloudflare.com | 88% | 90% | 45% | 100% | −12 |
| Bitwarden | bitwarden.com | 78% | 65% | 45% | 100% | −22 |
| Malwarebytes | malwarebytes.com | 72% | 90% | 45% | 45% | −28 |
| Apple | apple.com | 70% | 50% | 15% | 100% | −30 |
| 1Password | 1password.com | 68% | 45% | 15% | 98% | −32 |
| GitHub | github.com | 66% | 40% | 15% | 98% | −34 |
| BleepingComputer | bleepingcomputer.com | 63% | 75% | 15% | 40% | −37 |
| MacRumors | macrumors.com | 60% | 65% | 45% | 40% | −40 |
| Jamf | jamf.com | 53% | 45% | 45% | 43% | −47 |
How to read this table
- apple.com website headers score well; transport (15%) is the soft public signal — CrashStealer steals trust from Apple’s brand, not from apple.com DNS.
- 1password.com / bitwarden.com are in-scope because CrashStealer explicitly targets password-manager extensions.
- github.com appears because the Werkbit dropper’s first hop queried GitHub before fetching the payload — domain posture ≠ repo abuse risk.
- jamf.com at 53% is far from the 100% ideal; that does not diminish the research — it is a separate public-hygiene signal.
Audit links
- cloudflare.com
- bitwarden.com
- malwarebytes.com
- apple.com
- 1password.com
- github.com
- bleepingcomputer.com
- macrumors.com
- jamf.com
Website stack note
Passive website-tech probes on July 24, 2026 completed for story domains (0 notable among probed hosts):
| Domain | Stack signal |
|---|---|
| malwarebytes.com | WordPress (version hidden) |
| 1password.com | Next.js (version not exposed) |
| jamf.com / apple.com / bleepingcomputer.com / bitwarden.com / macrumors.com / cloudflare.com | No notable public CMS / PHP / short-horizon TLS flags |
Hidden WordPress / Next.js versions are common on hardened sites. They do not explain CrashStealer delivery — that chain abused notarization + CrashReporter impersonation, not a public CMS fingerprint.
These passive observations are point-in-time public signals. They do not prove exploitability or identify a breach path.
Priority actions for IT teams
- Block CrashReporter downloads — alert on DMGs/apps named CrashReporter and bundles claiming
com.apple.crashreporteroutside Apple paths. - Hunt LaunchAgents —
com.apple.crashreporter.helperunder~/Library/LaunchAgents/and copies under~/Library/Caches/com.apple.crashreporter/. - Watch notarized droppers — signed “meeting / setup” apps that shell out to
curl/ GitHub / unknown domains. - Detect
dscl -authonly+ Keychain unlock paired with hidden staging under~/.cache/com.apple.crashreporter/. - IR — if password entered: isolate, reimage, rotate credentials from a clean device, move crypto to new wallets.
Related trackers
- ClickLock Stealer Mac password coercion
- Apple macOS Tahoe / iOS / Safari security update
- WhatsApp fake document RMM malware
- Breach monitoring resources
Run a free Instant Cybersecurity Audit at audit.emailmenow.com or contact EmailMeNow IT Consulting for Mac endpoint hardening and DMARC / MTA-STS work aimed at the 100% ideal.
Sources: Jamf Threat Labs — CrashStealer: C++ macOS Infostealer Posing as Crash Reporter · BleepingComputer — New CrashStealer malware poses as Apple crash reporting tool · MacRumors — CrashStealer impersonates Apple tool · Help Net Security — CrashStealer password theft