CrashStealer: C++ macOS Infostealer Posing as Crash Reporter

CrashStealer is a newly identified macOS infostealer implemented in native C++. It masquerades as Apple's crash-reporting framework to harvest sensitive information from infected systems. The malware is delivered through a signed and notarized dropper application, allowing it to bypass macOS Gatekeeper security. Once executed, it validates user passwords locally using dscl, unlocks the login keychain, and collects a variety of sensitive data including browser credentials, cryptocurrency wallet extensions, password manager data, and keychain material. The stolen data is encrypted using AES-GCM and stored in hidden ZIP archives before being exfiltrated to a remote command-and-control server. To maintain persistence, CrashStealer copies itself to a hidden directory and installs a LaunchAgent. It employs advanced evasion techniques such as control-flow flattening, encrypted strings, and anti-debugging to resist reverse engineering and analysis. The campaign uses GitHub for initial payload staging and multiple fake collaboration software domains as social engineering lures.

The malware compromises user confidentiality by stealing sensitive credentials and keychain data, including browser passwords, cryptocurrency wallet extensions, and password manager information. This can lead to unauthorized access to user accounts, financial theft, and further compromise of the victim's environment. The use of a signed and notarized dropper allows the malware to bypass macOS Gatekeeper protections, increasing the likelihood of successful infection. Persistence mechanisms enable long-term access to compromised systems.

No official patch or remediation is indicated in the available data. Since the malware uses a signed and notarized dropper to bypass Gatekeeper, users should exercise caution when installing software, even if signed. Employ endpoint protection solutions capable of detecting malicious behavior and monitor for suspicious LaunchAgent installations and hidden directories. Restrict use of administrative privileges and consider using multi-factor authentication to protect sensitive accounts. Review and revoke any suspicious access or credentials if compromise is suspected. Check vendor advisories and security community updates for any emerging detection or removal tools.