Loading malware…
CrashStealer is a macOS information stealer that impersonates Apple’s crash-reporting utility to harvest sensitive user data. It is implemented primarily in native C++ and has been observed using a signed and Apple-notarized installer to bypass Gatekeeper trust checks before deploying a payload disguised as a legitimate system component. The malware validates a victim’s macOS password through a fake native-looking authorization prompt, then uses the captured credentials to unlock and copy login Keychain material and expand access to protected data sources.
CrashStealer targets credentials and other sensitive information stored in Chromium-based browsers and Firefox, cryptocurrency wallet extensions, password managers, and the macOS Keychain. It also collects selected user files from common document directories. Stolen data is encrypted client-side with AES-GCM, packaged for collection, and exfiltrated to attacker-controlled infrastructure. Observed samples also establish persistence on macOS through a LaunchAgent masquerading as an Apple-related component.
The malware uses a staged infection chain in which an initial installer retrieves additional instructions and downloads the final payload. Reported campaigns used a trojanized application themed as videoconferencing software, in some cases gated behind a meeting PIN, suggesting selective targeting. CrashStealer also incorporates anti-analysis and defense-evasion measures including obfuscation, encrypted strings, control-flow flattening, anti-debugging checks, ad hoc re-signing of payload components, and impersonation of legitimate Apple software. Researchers have noted overlap in objectives with other macOS stealers such as Atomic Stealer and MacSync, while distinguishing CrashStealer by its native C++ implementation and client-side encryption workflow.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
After the application is executed, the initial loader retrieves a shell script hosted on GitHub infrastructure. Once several layers of Base64 encoding have been decoded, the script downloads the primary malicious payload onto the system.
Interestingly, it carries a valid Apple developer certificate and has successfully passed Apple’s notarization process — meaning it cleared the automated prescan for malicious code. As a result, the attackers manage to bypass the operating system’s built-in Gatekeeper defense.
Use the previously captured credentials to gain access to Keychain, the built-in macOS password manager.
To establish persistence on the compromised system, the malware creates a copy of itself, re-signs the file using an ad hoc signature and installs a LaunchAgent under the label com.apple.crashreporter.helper.
Create a copy of itself and establish persistence to launch automatically every time macOS boots.
Persistence is established through familiar macOS mechanisms... creating a LaunchAgent named com.apple.crashreporter.helper... LaunchAgent configuration ensures execution during user logon while automatically restarting the malware should the process terminate unexpectedly.
CrashStealer validates victim credentials before initiating large-scale collection activities... the malware invokes legitimate macOS directory service utilities using dscl -authonly to verify credentials locally. Invalid passwords trigger repeated authentication prompts until the victim provides valid credentials.
Use the previously captured credentials to gain access to Keychain, the built-in macOS password manager.
To establish persistence on the compromised system, the malware creates a copy of itself, re-signs the file using an ad hoc signature and installs a LaunchAgent under the label com.apple.crashreporter.helper.
Create a copy of itself and establish persistence to launch automatically every time macOS boots.
Persistence is established through familiar macOS mechanisms... creating a LaunchAgent named com.apple.crashreporter.helper... LaunchAgent configuration ensures execution during user logon while automatically restarting the malware should the process terminate unexpectedly.
What sets it apart from the commodity stealer crowd is less what it collects than how it is built: client-side AES-GCM encryption of the collected files, and an emphasis on analysis resistance through control-flow flattening, encrypted strings and layered anti-debugging
A new form of malware is targeting macOS users by impersonating Apple’s built-in crash-reporting component to trick victims into installing a password-stealing payload.
Delete temporary files and other installation traces to make detection much harder.
Use the previously captured credentials to gain access to Keychain, the built-in macOS password manager.
Interestingly, it carries a valid Apple developer certificate and has successfully passed Apple’s notarization process — meaning it cleared the automated prescan for malicious code. As a result, the attackers manage to bypass the operating system’s built-in Gatekeeper defense.
CrashStealer retrieves them dynamically and reconstructs them through Base64 decoding before execution.
Crucially, this disk image is signed with a valid Apple developer ID and a notarization ticket, which enables it to clear Apple Gatekeeper, the macOS security feature designed to prevent malware execution on first launch.
Check the computer for installed security tools and malware analysis software.
What sets it apart from the commodity stealer crowd is less what it collects than how it is built: client-side AES-GCM encryption of the collected files, and an emphasis on analysis resistance through control-flow flattening, encrypted strings and layered anti-debugging
CrashStealer validates victim credentials before initiating large-scale collection activities... the malware invokes legitimate macOS directory service utilities using dscl -authonly to verify credentials locally. Invalid passwords trigger repeated authentication prompts until the victim provides valid credentials.
CrashStealer moves towards its true goal: stealing usernames, passwords and any other credentials stored in the browser, as well as stealing logins for cryptocurrency wallets, password managers and other keychain data
In addition, the malware collects all credentials and cookies stored in Chromium-based browsers — Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, and NAVER Whale — as well as Firefox.
the malware is designed to collect ... information maintained by password managers
CrashStealer validates victim credentials before initiating large-scale collection activities... the malware invokes legitimate macOS directory service utilities using dscl -authonly to verify credentials locally. Invalid passwords trigger repeated authentication prompts until the victim provides valid credentials.
CrashStealer also incorporates a dedicated file-search component that recursively searches user directories such as Documents and Downloads while intentionally excluding directories unlikely to contain valuable information.
Check the computer for installed security tools and malware analysis software.
What sets it apart from the commodity stealer crowd is less what it collects than how it is built: client-side AES-GCM encryption of the collected files, and an emphasis on analysis resistance through control-flow flattening, encrypted strings and layered anti-debugging
39 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a similar macOS stealer for comparison only.
Referenced as another macOS infostealer with overlapping objectives for comparison to AmnesiaStealer.
Mentioned for comparison as another stealer with similar objectives.
Mentioned as a comparable malware family with overlapping objectives to AmnesiaStealer.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.