CrashStealer macOS Infostealer Poses as Apple Crash Reporter to Harvest Passwords and Crypto Wallets
What Happened — Jamf Threat Labs identified a new macOS infostealer, CrashStealer, that masquerades as Apple’s native crash‑reporting utility. The signed DMG installer bypasses Gatekeeper, prompts users for their macOS password, then harvests Keychain entries, browser credentials, password‑manager data, and cryptocurrency wallets before exfiltrating the encrypted payload.
Why It Matters for Compliance & Audit Readiness
- The attack exploits weak endpoint access controls and a lack of user awareness—exactly the gaps SOC 2 CC6.2 (Logical Access) and CC3.1 (System Operations) are designed to mitigate.
- Continuous evidence of signed‑code enforcement, MFA on privileged accounts, and regular security‑awareness training are required audit artifacts to demonstrate “reasonable security” under the Trust Services Criteria.
- Verisq’s SOC2_ACCESS_CONTROLS capability can automatically collect and correlate Gatekeeper policy compliance, MFA logs, and endpoint inventory as audit‑ready evidence.
Who Is Affected
- Technology‑SaaS providers that ship macOS clients or manage employee devices.
- Enterprise endpoint users across all verticals that rely on macOS for daily operations.
Recommended Actions
- Enforce a strict allow‑list for macOS applications; require notarized, verified signatures and disable execution of unsigned DMGs.
- Verify that all privileged macOS accounts enforce MFA and that password prompts are validated against Apple’s native authentication APIs.
- Deploy security‑awareness training that highlights the look‑alike “CrashReporter” dialog and the risks of installing software from unverified sources.
Source: Help Net Security
Technical Notes
- Delivery vector: signed DMG (Developer ID Emil Grigorov) with stapled notarization, bypassing Gatekeeper.
- Payload written in native C++, uses AES‑GCM encryption, exfiltrates via libcurl to a GitHub‑hosted staging server.
- Harvested data: macOS Keychain, browser password stores, password‑manager vaults, cryptocurrency wallet files.
Source: Help Net Security