Updated

Updated · Fox News · Jul 21

Jamf Uncovers CrashStealer Mac Malware Targeting 80 Wallet Extensions and 14 Password Managers

Updated

Updated · Fox News · Jul 21

Jamf Uncovers CrashStealer Mac Malware Targeting 80 Wallet Extensions and 14 Password Managers

Q: CrashStealer mimics system alerts to steal passwords. How can you tell a real macOS prompt from a fake one?

The safest rule is to trust the context, not the look: a real macOS password prompt usually appears only after you initiated a clear system action, while a fake one often appears unexpectedly. With CrashStealer, the prompt is designed to look native, so appearance alone is unreliable. A real macOS prompt normally follows something obvious, such as installing software, changing system settings, unlocking a Keychain item, or approving a security action you just requested. If a password box appears right after opening an unfamiliar app, joining a meeting, or launching something called “CrashReporter” or “Werkbit Setup,” that is a major warning sign. Apple’s built-in Crash Reporter does not need you to download or manually open a separate “CrashReporter.dmg.” Behavior is another clue. Legitimate prompts can usually be canceled without drama. A suspicious prompt may reappear, feel out of place, or be paired with unusual requests such as broad file access. Security researchers also note that malware can trigger prompts through scripts, so the request may be technically convincing while still being malicious. The practical test is simple: pause and ask why your password is needed right now. If the reason is unclear, do not enter it. Cancel the prompt, quit the app, disconnect from the internet if needed, and check Login Items, permissions, and recent downloads. If you already typed your password, treat the Mac as compromised and change critical passwords from a clean device.

2 articles · Updated · Fox News · Jul 21

Active attacks detected in early July led Jamf Threat Labs to detail CrashStealer, a new Mac infostealer that masquerades as Apple’s Crash Reporter and steals credentials, Keychain data and crypto-wallet information.
A signed and notarized first-stage installer called Werkbit Setup helped the campaign clear Gatekeeper, then fetched a hidden CrashReporter.dmg payload that used the bundle identifier com.apple.crashreporter.
A fake macOS password prompt is central to the theft: if users enter the correct login password, the malware validates it locally, unlocks the login Keychain and copies sensitive data.
Jamf said CrashStealer targets Safari, Firefox and Chromium data, about 80 cryptocurrency wallet extensions and 14 password managers, then encrypts stolen files with AES-256-GCM before uploading them.
The campaign shows how trusted Apple signing and notarization can be abused before revocation; Jamf reported the Developer Team ID to Apple, but did not say how many users were infected.

Sources

Fox News5h ago

Jamf Threat Labs Uncovers CrashStealer Mac Malware Impersonating Apple Software, Stealing Credentials and Crypto Wallets

allaboutcookies.org5h ago

Your Next Apple Crash Report Could Be Stealing Your Mac Passwords | All About Cookies

CrashStealer mimics system alerts to steal passwords. How can you tell a real macOS prompt from a fake one?

If malware can carry Apple's official seal of approval, is the Mac's reputation for security now a myth?

80 Crypto Wallets and 14 Password Managers Targeted: Inside the CrashStealer macOS Malware Breach of 2026

Overview

CrashStealer is a new and sophisticated malware targeting macOS users by pretending to be Apple’s crash-reporting tool. It tricks victims into installing a malicious payload that steals sensitive information, especially passwords. Once installed, CrashStealer harvests a wide range of personal and financial data, including credentials from popular browsers and cryptocurrency wallets. This threat highlights that even Apple users are vulnerable to evolving cyberattacks. The discovery of CrashStealer is a strong reminder that relying on macOS alone is not enough for security, and users must stay vigilant against deceptive threats.

...