Malware Alert: Your Mac’s Next ‘Crash Report’ Might Actually Be Malware

If you’re a Mac user, beware of any system prompts that request your credentials in order to send reports to Apple. A new malware—dubbed CrashStealer—is posing as a legitimate crash-reporting tool while stealing keychain data, local files, and data from browsers, password managers, and crypto wallets.

CrashStealer impersonates Apple on macOS

This macOS infostealer, which was identified by security firm Jamf, looks like a legitimate application. It goes by ‘CrashReporter.app,’ uses a recognizable icon and metadata, and is delivered by a dropper signed and notarized by Apple. Targets can download the installer from a fake software site promoting the ‘Werkbit’ meeting platform and requires a PIN to access. From there, installation follows a similar process to any other real app, as the campaign relies on social engineering to trick targets into adding the payload directly to their own devices. As BleepingComputer describes, its technical setup allows it to avoid detection from macOS’ anti-malware tool.

How CrashStealer Works

When the infostealer runs, it pretends to be Apple’s crash reporter, displaying a prompt that looks exactly like a macOS authorization request to make changes to system preferences. Users are asked to enter their password to allow these changes, and the malware validates the credential locally. If the password is wrong, the prompt runs again until the correct credential is supplied. With the system password, threat actors can unlock the user’s Keychain and all of the encrypted data within, such as wifi and app passwords, certificates, and tokens.

Targeted Data and Browsers

CrashStealer also appears to target other data on users’ devices, including:

• Files from Documents and Downloads folders.
• Credentials and cookies from Firefox and Chromium-based browsers.
• 14 password managers, including popular apps like 1Password, Bitwarden, LastPass, Dashlane, NordPass, and Keeper.
• 80 cryptocurrency wallet extensions.

The malware is able to encrypt the stolen data, put it in a hidden ZIP archive, and upload it to attackers’ servers.

Protecting Your Mac from CrashStealer

It’s not clear exactly how threat actors are targeting the distribution of this specific malware, but use caution when downloading and installing apps to your device, as attackers are able to run highly sophisticated campaigns that raise very few red flags. If you aren’t 100% sure of the origin or legitimacy of an app or software, don’t install it. Be wary of system processes that require you to enter your credentials to run—an action many of us take frequently without thinking. For CrashStealer specifically, know that crash reports and diagnostics sent to Apple do not require a password. You may be asked whether you want to provide this information, but you shouldn’t need to authenticate it in any way.

Steps to Follow

Here are some steps to protect your Mac from CrashStealer:

1. Use caution when downloading and installing apps to your device.
2. Verify the origin and legitimacy of an app or software before installing it.
3. Be wary of system processes that require you to enter your credentials to run.
4. Know that crash reports and diagnostics sent to Apple do not require a password.

By following these steps, you can significantly reduce the risk of your Mac falling victim to the CrashStealer malware.