Threats Tagged 'crashstealer'

CrashStealer is a macOS infostealer malware written in native C++ that impersonates Apple's crash-reporting framework to steal sensitive user data. It is distributed via a signed and notarized dropper application that bypasses Gatekeeper protections. The malware locally validates victim passwords, unlocks the login keychain, and collects browser credentials, cryptocurrency wallet extensions, password manager data, and keychain contents. Data is encrypted with AES-GCM, packaged into hidden ZIP archives, and exfiltrated to a command-and-control server. Persistence is achieved by copying itself to a hidden directory and installing a LaunchAgent. The malware uses anti-analysis techniques including control-flow flattening, encrypted strings, and anti-debugging. Initial staging uses GitHub, and the campaign employs fake collaboration software domains as lures.