CrashStealer pretends as Apple crash reporter, steals data

A new and sophisticated information-stealing malware targeting macOS, dubbed "CrashStealer," has been identified in active attacks, security researchers confirmed on July 14, 2026. The malware disguises itself as Apple's legitimate crash-reporting tool to steal passwords, cryptocurrency wallet data, and a wide array of sensitive files.

The threat was first observed by researchers at Jamf in early May 2026 as a suspicious sample and moved into active deployment by early July. The attack chain begins when a victim downloads a disk image named "Werkbit Setup" from a fake software site, werkbit.io, which was registered in late June. Access to the download is gated behind a private meeting PIN, a tactic analysts say was used to limit visibility and target specific victims.

Crucially, the initial "Werkbit" application is signed with a valid Apple Developer ID and carries Apple's notarization, allowing it to bypass the macOS Gatekeeper security system without generating warnings. Once launched, this dropper fetches and installs the final payload from attacker-controlled infrastructure.

The payload itself is an application bundle named "CrashReporter.app," which mimics Apple's system...