CrashStealer for macOS: notarized chain bypasses Gatekeeper and steals browser and wallet data

Colleagues, I’d like to draw your attention to a cybersecurity threat.

I’ve identified a new macOS stealer, CrashStealer. It is distributed via a signed and notarized dropper, allowing it to pass Gatekeeper checks.

The chain then looks like this:
• downloading the next payload via a helper script;
• local verification of the user’s password;
• collection of data from browsers, crypto wallets, password managers, and Keychain;
• encryption of the collected data with AES-GCM and export to ZIP.

Persistence, anti-debugging, and attempts to obstruct analysis are particularly concerning.

Why it matters: even macOS apps with a valid signature no longer appear safe by default.

How do you verify trust in signed files in your environment?

#macOS #cybersecurity #malware #infostealer