macOS CrashStealer Malware Disguised as Apple CrashReporter Steals Keychain and Crypto Wallet Data

New macOS “CrashStealer” Malware Masquerades as Apple CrashReporter to Harvest Credentials & Crypto Wallets

What Happened — Researchers identified a macOS‑only infostealer named CrashStealer that disguises its binary as Apple’s native CrashReporter.app and registers a launch agent with a legitimate‑looking icon. The dropper is signed and Apple‑notarized, allowing it to bypass Gatekeeper without warning. Once executed, it prompts for an admin password, extracts Keychain entries, browser cookies, password‑manager vaults, and over 80 cryptocurrency wallet extensions, encrypts the data with AES‑256‑GCM, and exfiltrates it via libcurl.

Why It Matters for Compliance & Audit Readiness

• Demonstrates how attackers can subvert trusted macOS controls to obtain privileged credentials – a classic failure of SOC 2 Access Controls (CC6.1, CC6.2).
• Highlights the need for continuous evidence that privileged‑access policies, MFA enforcement, and endpoint‑hardening controls are enforced and auditable.
• Shows the importance of security‑awareness training that teaches users to verify prompts and notarized installers, providing a defensible audit trail of training completion.

Who Is Affected — Enterprises with macOS fleets (technology, design, finance, education, and any organization that issues Apple laptops or desktops).

Recommended Actions

• Map the incident to SOC 2 Access Control criteria (CC6.1 – logical access, CC6.2 – privileged access) and verify that MFA, least‑privilege, and credential‑vault monitoring are in place.
• Deploy endpoint‑detection tools that flag unsigned launch agents and notarized installers that deviate from approved software baselines.
• Conduct a targeted security‑awareness session on macOS‑specific social‑engineering cues (fake admin prompts, notarized installers).
• Collect and retain logs from Gatekeeper, MDM, and Keychain access as continuous audit evidence.

Source: BleepingComputer

Technical Notes

• Attack vector: notarized malicious installer bypasses Gatekeeper.
• Payload mimics CrashReporter.app and creates com.apple.crashreporter.helper launch agent.
• Data exfiltration uses AES‑256‑GCM encryption, hidden ZIP archives, and libcurl over HTTPS.
• Targets: macOS Keychain, Chromium/Firefox cookies, 14 password managers, 80+ crypto wallet extensions, user Documents/Downloads.

Source: Jamf analysis, BleepingComputer article