Nothing Like a Convincing Impostor to Steal Everything

In CrashStealer: C++ macOS Infostealer Posing as Crash Reporter, Jamf Threat Labs documents malware designed to look like Apple’s legitimate crash-reporting software.

“CrashReporter requires Full Disk Access for system administration.”

The attack begins with a polished installer that was signed with a valid Apple Developer ID and notarized by Apple, allowing it to pass Gatekeeper. It then installs a fake CrashReporter application and presents a convincing macOS password prompt.

Nothing like a good false actor to steal all your stuff.

Once given the password, CrashStealer validates it, unlocks the victim’s Keychain, and collects browser credentials, cookies, local files, cryptocurrency wallets, and data from 14 password managers. It then encrypts the stolen information and sends it to the attacker’s server.

The disturbing part is that the normal signs people are taught to trust were present. The installer was signed. It was notarized. It looked like an Apple utility and displayed a native-looking authorization request.

None of those signals proved that the software was safe.

Security features can reduce risk, but attackers increasingly understand how to borrow the appearance of trust and persuade users to complete the attack themselves. A familiar icon and a legitimate-looking password prompt may be the most dangerous parts of the application.

Read Jamf Threat Labs’ full CrashStealer analysis.