A polished installer can make risky software feel routine.You see a familiar Mac window, follow the directions and enter your password when asked.
By then, the app may already be working against you.Security researchers at Jamf Threat Labs have uncovered CrashStealer, a new Mac information stealer that impersonates Apple's crash-reporting software.Jamf first tracked the malware in May 2026 while it appeared to be under development.
By early July, researchers detected it in active attacks.Free live CyberGuy class: Sick of Spam? Join us July 22Join us this Wednesday, July 22, at 1 PM ET for a free CyberGuy Live class that will help you cut down on robocalls, spam texts, junk email and other unwanted messages.Kurt "CyberGuy" Knutsson will walk you step by step through simple ways to filter spam, clean up your inbox and recognize the messages that could put your personal information at risk.
No technical experience is needed.You’ll also receive our spam-stopping checklist, and every registrant will get a link to the class recording afterward.Reserve your free spot today at CyberGuyLive.com .REDHOOK ANDROID MALWARE CAN QUIETLY HIJACK YOUR PHONEMac users are being warned about CrashStealer, a credential-stealing malware that uses fake password prompts and a signed installer to evade suspicion.
(Photo by Ute Grabowsky/Photothek via Getty Images)CrashStealer targets information many people rely on every day.It searches for browser credentials, password-manager data and cryptocurrency wallet information.
The malware can copy the Mac login Keychain as well.The malware stands out because its developers wrote it in native C++.
Many common Mac stealers rely on AppleScript or simpler software wrappers.CrashStealer also encrypts the files it collects before sending them to an attacker-controlled server.Meanwhile, anti-debugging features make the malware harder for researchers to examine.
However, the first app a victim sees isn’t called CrashStealer.The attack begins w...