Loading story…
A newly identified macOS infostealer dubbed CrashStealer is being used in active attacks by masquerading as Apple’s crash-reporting utility and abusing a valid Apple Developer ID with notarization to bypass Gatekeeper on first launch. Distributed in a disk image labeled "Werkbit Setup", the malware presents a fake macOS authorization prompt to capture the user’s system password, then steals browser credentials, Keychain data, password manager information, cryptocurrency wallet and extension data, and files from the Documents and Downloads directories.
Researchers said the C++ malware uses a loader to fetch a Base64-obfuscated shell script from GitHub infrastructure, which then downloads the main payload disguised as CrashReporter.app with the bundle identifier com.apple.crashreporter. CrashStealer encrypts stolen data with AES-256-GCM, packages it into ZIP archives, and exfiltrates it to an attacker-controlled server via libcurl; it also establishes persistence by copying and ad hoc re-signing itself before installing a LaunchAgent named com.apple.crashreporter.helper. Analysts also noted anti-debugging and control-flow obfuscation features designed to complicate detection and reverse engineering.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers believe the CrashStealer macOS infostealer had been under development since May before later being used in active attacks.
Public reporting described CrashStealer as a C++-based macOS infostealer delivered as a signed and notarized "Werkbit Setup" disk image that bypasses Gatekeeper, steals credentials and wallet data, exfiltrates encrypted archives, and installs a LaunchAgent for persistence.
Jamf reported discovering CrashStealer after a suspicious sample was uploaded to VirusTotal, leading to identification of the new macOS infostealer impersonating Apple's crash reporter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cert.gov.az
Open sourcecysecurity.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a new macOS infostealer, **AmnesiaStealer**, being spread through **ClickFix-style** social engineering that tricks users into copying and pasting a malicious command into Terminal, including via fake GitHub download pages. The multi-stage infection chain uses a Bash loader to profile the host and retrieve a processor-specific Mach-O payload written in Go, then steals browser passwords, Apple Keychain data, cached credentials, Telegram sessions, Apple Notes, documents, and other sensitive information from infected systems. Investigators said the malware also includes cryptocurrency-theft functionality that can transfer wallet funds to attacker-controlled addresses, and a later-stage component, `stream_module`, can be fetched on demand to clone browser profiles and attach to the Chrome DevTools Protocol for covert access to already authenticated browser sessions. Huntress linked parts of the loader, payload-hosting, and command-and-control infrastructure to the **Aeza Group**, a sanctioned Russian bulletproof hosting provider tied to cybercrime, while Jamf noted some privacy-bypass methods are outdated on newer macOS releases even though the malware’s credential theft and session-hijacking features remain effective.
Aug 17, 2026
Threat actors are increasingly targeting macOS users with **infostealers** and distribution-as-a-service models, reflecting a broader “gold rush” in Apple-focused malware development. Reporting highlights macOS stealers targeting browser credentials and cryptocurrency assets (including seed phrases) and notes tactics to evade Apple controls such as obtaining valid Apple developer signatures to bypass *Gatekeeper*; one cited example is *MacSync* being notarized and signed under Team ID `GNJLS3UYZ4`. The same reporting describes ecosystem-scale enablement, including large-scale compromise of WordPress sites for distribution and novel command-and-control approaches such as using blockchain smart contracts (e.g., on **BNB Smart Chain**), alongside paid-traffic abuse (e.g., promoting malicious AI chat content via ads) to push stealer payloads. Separately, a Darktrace-described investigation details a **multi-stage macOS malware** campaign that prioritizes *social engineering* over exploitation to defeat Apple’s **Transparency, Consent, and Control (TCC)** privacy framework. Victims are lured via phishing to open an AppleScript masquerading as a document (`Confirmation_Token_Vesting.docx.scpt`), which displays a fake “Compatibility” error and instructs the user to launch a “Compatibility Wizard” (e.g., using a keyboard shortcut) that effectively tricks them into authorizing execution and granting access. Together, the reporting indicates macOS threats are increasingly succeeding by combining credential/crypto theft objectives with user-prompt manipulation and trust-abuse techniques rather than relying on kernel or sandbox escapes.
Jun 29, 2026
Researchers reported a new macOS infostealer dubbed **ClickLock Stealer** that tricks users into pasting a malicious `bash` command into Terminal through ClickFix-style pages masquerading as Cloudflare verification prompts. Group-IB said the malware has been active since at least late May and has targeted at least 100 users in 33 countries, with more than half of victims in Europe. Once launched, the malware downloads multiple payloads for browser credential theft, cryptocurrency wallet theft, Keychain theft, password manager and FileZilla credential collection, shell history harvesting, and backdoor installation, then exfiltrates the stolen data to a Telegram bot. Researchers also linked the campaign to LaunchAgent persistence and a backdoor called **goyim** derived largely from GSocket tooling. ClickLock does not rely on a software exploit or privilege escalation; instead, it abuses user execution and suppresses defenses by repeatedly killing visible applications and `NotificationCenter`, sometimes every 210 milliseconds, until victims enter their macOS password and approve Keychain access. Apple separately published guidance warning that scammers increasingly use websites, chat agents, messaging platforms, and email to socially engineer Mac users into pasting unsafe Terminal commands, and said macOS may warn or block commands and scripts associated with known malware. Apple said such alerts mean the Mac has not yet been harmed and advised users not to run untrusted commands or scripts unless they fully trust the source.
Aug 11, 2026