CrashStealer Malware Uses Fake Mac Crash Reports to Steal Passwords

Mac users are being targeted by a new information-stealing program that disguises itself as an Apple crash-reporting utility. Researchers at Jamf Threat Labs identified the malware, named CrashStealer, after detecting working versions in the wild in early July 2026. Earlier samples appeared in May but seemed incomplete, suggesting the malware was still being developed. In the campaign investigated by Jamf, CrashStealer was distributed inside a disk image named “Werkbit Setup.” Once installed, the malicious application appeared as “CrashReporter.app,” using a name and interface designed to look like a normal macOS system tool.

That disguise is effective because crash reports are a familiar part of using a computer. When an application stops responding or unexpectedly closes, macOS may display technical information about what happened. A convincing imitation can therefore look like an ordinary system message rather than malware.

CrashStealer Uses a Fake Password Prompt

After it opens, CrashStealer displays a password request that resembles a normal macOS authentication window and claims the password is needed to view protected crash information. According to Jamf, the malware attempts to use the entered password to unlock the victim’s login Keychain. If successful, it may gain access to credentials and other sensitive information stored on the Mac.

Unexpected password requests should always be treated cautiously. Instead of judging the prompt only by how authentic it looks, consider whether the action should require the Mac login password at all. Simply viewing a crash report or opening an ordinary file should not require authentication without a clear reason. When an unfamiliar application suddenly requests a password, cancel the prompt, close the application, check where the software came from, and visit the developer’s official website separately rather than following links or instructions provided by the application.

What Information Does CrashStealer Target?

CrashStealer is designed to collect a broad range of valuable information, including:

• Browser passwords and cookies
• macOS Keychain data
• Password manager information
• Cryptocurrency wallets and private keys
• Documents and other personal files

Browser cookies are particularly useful to attackers because some cookies represent an already authenticated website session. If that session can be copied and reused, an attacker may be able to access an account without entering its password again. This does not make multifactor authentication useless, but it does show why protecting the device itself remains important. Some websites request authentication again when suspicious activity is detected, while others may continue accepting an existing session.

Password managers remain considerably safer than reusing passwords, but they cannot completely protect information on an infected computer. Malware may target an unlocked password database, browser integration, exported information, or credentials captured through a fake prompt. The threat is also not limited to cryptocurrency owners. Tax documents, identification records, financial statements, private messages, work files, and saved notes may all be useful to an attacker.

A Signed and Notarized App Can Still Be Malicious

Jamf reported that the application used to distribute CrashStealer was signed and notarized. Apple’s notarization service automatically scans Developer ID-signed software for known malicious content and code-signing problems. It is an important security layer, but Apple notes that notarization is not the same as a full App Store review.

A malicious application may avoid detection during the original automated scan, or an attacker may misuse a legitimate or compromised developer account. Apple can revoke the certificate after the threat is discovered, but users may still encounter the software before that happens. Signing and notarization should therefore be treated as useful trust signals, not absolute proof that an application is safe. Users should also consider where the application came from, whether its behaviour matches its stated purpose, and whether its permission requests make sense.

CrashStealer Can Remain Active After a Restart

CrashStealer creates a LaunchAgent so it can start again when the user logs into the Mac. LaunchAgents are legitimate macOS components commonly used by applications for updates, synchronization, menu bar utilities, and other background functions. Malware can misuse the same system to maintain persistence after the original installer has closed. This means deleting the downloaded disk image may not remove the infection because files may already have been copied elsewhere, with background instructions configured to reopen them later.

Mac users can review software that starts automatically under System Settings > General > Login Items & Extensions. Apple provides additional details in its guide to managing login items and background tasks. An unfamiliar background item does not automatically mean the Mac is infected, but it should be investigated before being allowed to remain active.

What to Do If You Opened a Suspicious Installer

Anyone who may have opened CrashStealer or another suspicious installer should avoid entering additional passwords or accessing sensitive accounts from the affected Mac. Recommended steps include:

• Disconnect the Mac from the internet if the threat may still be active
• Run a scan using trusted Mac security software
• Review Login Items & Extensions for unfamiliar entries
• Change important passwords from a separate trusted device
• Sign out unknown or unnecessary account sessions
• Review financial and cryptocurrency accounts for unusual activity

Start with the primary email account because it is often used to reset passwords for other services. Next, secure the Apple Account, password manager, financial services, cloud storage, social media, and other important accounts. Apple users can also review devices signed into their Apple Account and remove any they do not recognize. Changing a password does not always immediately end every existing session, so use each service’s option to sign out other devices or revoke active sessions when available.

How Mac Users Can Reduce the Risk

Download applications from the Mac App Store or the developer’s verified website whenever possible. Search advertisements and sponsored results should not automatically be trusted, even when they appear above the legitimate website. Before installing unfamiliar software, check the address carefully and consider whether the requested permissions match what the application is supposed to do. A basic utility should not unexpectedly need access to browser cookies, passwords, cryptocurrency wallets, private documents, or Full Disk Access.

Instructions telling users to disable security features, run unfamiliar Terminal commands, paste code into Script Editor, or bypass macOS warnings should also be treated carefully. Right-clicking an application and selecting Open is a legitimate macOS feature, but an unknown website insisting that security protections must be bypassed is a warning sign.

CrashStealer demonstrates that modern Mac malware does not always need to defeat every security control directly. Sometimes the attacker’s main goal is simply to make a malicious password request look routine. The safest response to an unexpected prompt is not to enter the password and investigate afterward. It is to stop, close the application, and confirm what is requesting access before providing anything sensitive.