Follow ZDNET: Add us as a preferred source on Google.
ZDNET’s key takeaways
- New MacOS malware masquerades as Apple’s crash reporter.
- CrashStealer was just released into the wild.
- Adopt these habits to protect yourself and your Mac from infection.
A new form of malware is masquerading as Apple’s crash reporting tool to target MacOS users and harvest their data, account credentials, keychain entries, and cryptocurrency wallets.
Also: Why this fully agentic ransomware attack is giving researchers nightmares
In a July 13 research advisory, Jamf cybersecurity researchers said the malware, dubbed “CrashStealer,” is a C++ infostealer that first appeared on their radar following a suspicious upload to VirusTotal. It appears that the malware was in development around May but has now been released into the wild.
The CrashStealer attack and what to look out for
You’ve probably encountered Apple’s legitimate crash reporting tool, which appears when software crashes or quits unexpectedly — a pop-up window asks whether you want to report the error.
When the malware lands on a MacOS machine, it impersonates Apple’s crash reporter by using the aliases CrashReporter.dmg (for installation), CrashReporter.app (for the application bundle), and a legitimate-looking icon.
Also: These two critical Mac security features are off by default – how to turn them on and why you should
While this malware contains many of the basic info-stealing capabilities you would expect, it also has an interesting prompt. CrashReporter tries to unlock the keychain by displaying a fake password prompt that mimics a genuine MacOS authorization request.
The malware then validates these stolen credentials locally before targeting installed password managers, browsers, and cryptocurrency wallets. Passwords are then whisked off in an encrypted package to an attacker-controlled server.
How infostealers actually land on your Mac
Some infostealers, such as CrashStealer, arrive on your Mac as disk images. Disk images, which end in .dmg, are the standard way to install software on a Mac — you click them, drag them to the Applications folder, and begin the installation process.
What makes this case interesting is that CrashStealer’s main .dmg file, distributed as “Werkbit Setup” — which packages up CrashReporter.dmg — is a signed and Apple-notarized dropper disguised as a disk image.
“Because the dropper carries a valid Developer ID and a stapled notarization ticket, it clears Gatekeeper on first launch, in contrast to the ad-hoc-signed payload it installs,” the researchers note.
Also: 6 MacOS settings I immediately change on every new Mac – and why
In other words, the .dmg file appears to be a legitimate, trustworthy utility, and there are no immediate red flags.
Another major attack vector for MacOS is ClickFix. This technique relies on social engineering to lure a user into entering and executing a command prompt themselves, often with copy-and-paste instructions to “fix” an issue on their PC or to resolve a CAPTCHA.
Yet another angle is AI. As described by Huntress researchers, Atomic MacOS Stealer is being distributed through poisoned AI chatbot conversations that lead unwitting victims to malicious websites and payloads.
The three habits that block most of them
Remember when we considered MacOS, and Apple machines in general, impervious to most forms of malware? This was even part of Apple’s own marketing campaigns.
That’s now far from the truth. We also need to consider the impact that AI is having on the cybercriminal world. AI is being abused to write malicious code, to improve phishing emails and campaigns, and was recently discovered as the backbone of a fully agentic ransomware attack chain. It might be a matter of months or only a few short years before the traditional MacOS attack vectors are replaced by AI-related threats.
Also: The best malware removal software: Expert tested and reviewed
However, for now, there are three habits you can adopt to steer clear of threats like CrashStealer:
- Always check a .dmg source. You can’t really know what’s in a .dmg package from the surface, and if you are downloading cracked or pirated software, you are at high risk of running malware on your own machine.
- Verify password requests. Gatekeeper prompts and warnings exist for a good reason, and so these should not be ignored. If you encounter a pop-up or alert on your Mac that you didn’t expect, be cautious about submitting your password. For example, if you’ve opened your VPN app and it needs an update, that might require your password. But if you’re casually browsing and an unknown system process requests the same, this could be a sign of infection.
- Keep your MacOS system updated. Many of us are guilty of this — we don’t want an update to interrupt our daily routine, work, or entertainment, and so we ignore OS prompts and App Store update notifications. However, these updates often include bug fixes and upgrades that strengthen our security, protecting not only our machines but also our data.
