CrashStealer macOS Malware Uses Notarized Dropper to Bypass Gatekeeper
What Happened — Researchers at Jamf Threat Labs identified a new macOS information‑stealer named CrashStealer. The malware is written in native C++, uses a notarized dropper to satisfy Gatekeeper, and validates the victim’s login password locally before exfiltrating credentials, browser data, and other sensitive files.
Why It Matters for Compliance & Audit Readiness
- The technique directly challenges the effectiveness of endpoint access‑control policies that SOC 2 expects organizations to enforce (CC6.1 – Logical Access).
- Demonstrates the need for continuous evidence that only approved, signed binaries run on corporate Macs – a control that can be verified with automated monitoring.
- Highlights the importance of Security Awareness Training to recognize social‑engineering vectors that deliver such dropper files.
Who Is Affected – Any organization that permits macOS devices in its environment, spanning technology, finance, professional services, and education sectors.
Recommended Actions
- Update your macOS endpoint hardening policy to require notarized, organization‑signed binaries only; map this to SOC 2 CC6.1.
- Deploy continuous endpoint detection and response (EDR) that logs code‑signing verification and alerts on unsigned executables.
- Refresh Security Awareness Training to cover macOS‑specific phishing and dropper delivery methods.
Source: The Hacker News
Technical Notes – CrashStealer is a native C++ binary that passes Apple’s Gatekeeper by leveraging a valid Apple notarization certificate. It harvests passwords, browser cookies, and system information before sending them to a C2 server. No CVE is associated; the threat relies on abuse of trusted signing mechanisms. Source: same as above