New macOS infostealer CrashStealer steals passwords and crypto wallets via signed installer

Forbes reported that a new infostealer malware named CrashStealer has been used in attacks against macOS systems. The malware unlocked the Apple Keychain, granting access to encrypted password vaults. It also targeted Chrome and Firefox browser cookies and passwords, 14 password managers, 80 cryptocurrency wallets, and files in the Documents and Downloads folders.

The malware arrived through a signed and notarized dropper that cleared Gatekeeper protections before fetching, re-signing, and launching the payload. Victims were required to download a malicious Werkbit app installer that carried a legitimate developer ID. Apple revoked the credentials tied to the Werkbit application after Jamf researchers notified the company.

CrashStealer employs client-side AES-GCM encryption of collected files along with encrypted strings and layered anti-debugging techniques. Security researcher Thijs Xhaflaire stated that the delivery chain shows real care in bypassing initial protections.

Piyush Sharma, CEO of Tuskira, said the malware impersonates a trusted Apple crash-reporting flow to obtain credentials, keychain data, and session material.

He added that organizations should test whether existing controls detect or block paths reachable by stolen credentials and continuously validate reachable identities and systems.