New Mac Malware Mimics Apple's Crash Reporter

A novel form of malware named CrashStealer is actively circulating, specifically targeting MacOS users by masquerading as Apple's legitimate crash reporting utility. This C++ infostealer, first identified by cybersecurity researchers, is designed to steal a wide range of sensitive information. Its objectives include harvesting user data, account credentials, critical keychain entries, and even cryptocurrency wallet details.

CrashStealer employs a deceptive tactic, mimicking the appearance and functionality of Apple's genuine crash reporter to trick users into granting it access. The malware arrives disguised as a disk image, often packaged within a signed and Apple-notarized dropper. This allows it to bypass MacOS's Gatekeeper security protections, presenting itself as a trustworthy application upon initial launch.

Once active on a system, CrashStealer attempts to exfiltrate stolen credentials by displaying a fake password prompt, closely resembling a legitimate MacOS authorization request. It then targets password managers, web browsers, and cryptocurrency wallets, encrypting the pilfered information before transmitting it to an attacker-controlled server. As AI continues to evolve, traditional MacOS attack vectors may soon be supplanted by AI-driven threats.