CrashStealer is a macOS infostealer malware that masquerades as the built-in CrashReporter tool and is delivered through a fake videoconferencing app called Werkbit. The initial installer is signed with a valid Apple developer certificate and notarized, allowing it to bypass macOS Gatekeeper protections. After installation, the malware fetches its payload from attacker-controlled servers and runs without user suspicion. It displays a fake macOS password prompt to capture user credentials, which it verifies before proceeding. CrashStealer then accesses and steals data from the macOS Keychain, 14 popular third-party password managers, credentials and cookies from Chromium-based and Firefox browsers, and data from 80 crypto wallet extensions. It also scans user Documents and Downloads folders for files of interest. The stolen data is encrypted with AES-256-GCM and exfiltrated to the attackers. The malware establishes persistence by copying itself to launch at system startup and deletes installation traces to avoid detection. Distribution is controlled via a meeting PIN mechanism, limiting victims to pre-selected targets. The malware was first observed in May 2026 and active in the wild by July 2026. Kaspersky detects it with heuristics under HEUR:Trojan-Downloader.OSX.Agent.gen and HEUR:Trojan-PSW.OSX.Agent.gen.

CrashStealer compromises macOS systems by stealing a wide range of sensitive information including system Keychain credentials, data from multiple third-party password managers, browser passwords and cookies, crypto wallet extension data, and user documents. This can lead to credential theft, unauthorized access to user accounts, financial theft especially from cryptocurrency wallets, and exposure of private documents. The malware evades macOS built-in defenses by abusing notarization and developer certificates, and uses social engineering to capture passwords. Persistence and anti-forensic measures make detection and removal more difficult.

No official patch or fix is available as this is malware rather than a software vulnerability. Users should avoid downloading software from untrusted sources and verify applications before installation. Sticking to official app stores and verified developers reduces risk. Using reliable security solutions that detect and block malware like CrashStealer is recommended. Users should be cautious of unexpected password prompts and avoid entering credentials unless certain of legitimacy. Keeping credentials in secure password managers not targeted by this malware can reduce impact. Kaspersky security products detect this malware with heuristic signatures. Regular backups and monitoring for unusual system behavior can aid recovery.