CrashStealer: the new Mac malware that slips past Apple's own safety checks
Researchers at Jamf Threat Labs say the C++-based stealer used an Apple-notarised installer to bypass Gatekeeper and grab passwords, browser data and crypto wallets from macOS users.
Key points
- Jamf Threat Labs has identified a new macOS information stealer called CrashStealer, written in native C++ rather than the usual AppleScript or Objective-C.
- The malware arrived inside an installer that had been signed and notarised by Apple, meaning it passed the built-in Gatekeeper safety check that normally warns users about untrusted apps.
- CrashStealer verifies the victim's login password on the machine itself before sending stolen data out, a trick designed to avoid network noise that antivirus tools might flag.
- Once running, it targets saved browser passwords, cookies, Keychain data (Apple's built-in password vault) and cryptocurrency wallet files.
- Apple can revoke the developer certificate behind the notarised installer, but users who already ran it are not automatically cleaned up.
A new piece of Mac malware is doing something that shouldn't be easy: walking straight past Apple's front-door security check.
Researchers at Jamf Threat Labs have named it CrashStealer. It's an information stealer, malicious software designed to sit quietly on a machine and copy out anything valuable it finds, from saved website passwords to cryptocurrency wallet files.
How did the malware get past Apple's checks?
It used an installer that Apple itself had approved. Every Mac runs a security feature called Gatekeeper, which checks whether an app has been "notarised" by Apple, a process where Apple scans the software and issues a digital stamp of approval. Software lacking that stamp triggers a warning; software carrying it usually opens without a fuss.
CrashStealer's dropper, the small program that plants the real malware, carried a valid Apple notarisation. So Gatekeeper waved it through, and the user saw no pop-up warning about an unidentified developer.
This isn't a flaw in Gatekeeper as such. It's a reminder that notarisation is an automated malware scan, not a full audit. Attackers who register a developer account and submit a clean-looking installer can, and clearly do, get past it.
What is different about how it is built?
Most Mac stealers over the last two years have been written in AppleScript or wrapped in Objective-C. Those are easier to write and easier for security tools to detect. CrashStealer is written in native C++, according to Jamf, which makes the code harder to analyse and easier to disguise.
It also handles the victim's password carefully. Before sending anything to its operators, it verifies the login password locally on the Mac, so it doesn't need to call home repeatedly or brute-force credentials across the network. Those are exactly the behaviours antivirus products are trained to flag.
Once it's satisfied, it goes hunting: saved browser credentials, cookies, Keychain data and files belonging to cryptocurrency wallets. That's the same haul targeted by stealers like Atomic and Poseidon. Our earlier report on PamStealer, filed 3 July 2026, showed a near-identical shopping list from a dropper that posed as a clipboard utility.
Should Mac users be worried?
Mildly, and specifically. Home users who install software only from the Mac App Store or well-known vendors' own sites are at low risk. The people getting hit by this class of malware tend to be chasing cracked apps, pirated games or "free" versions of paid tools posted on forums and Telegram channels. That's the delivery route stealers like Atomic and Poseidon have used all year.
If you think you may have installed something dodgy recently, a few practical steps:
- Change the passwords for any accounts saved in your browser or Keychain, prioritising email, banking and crypto exchanges.
- Turn on two-factor authentication wherever it's offered, so a stolen password alone isn't enough.
- Move any cryptocurrency out of software wallets on that Mac and into a fresh wallet on a clean device.
- Run a reputable Mac security scanner and, if in doubt, back up your documents and reinstall macOS.
Apple can revoke the developer certificate that signed the dropper, and usually does once researchers report it. New infections stop. Old ones don't reverse themselves.
What matters most here is the notarisation angle, not the stealer's payload, which is routine. The story to watch is whether Apple tightens automated review after repeated cases like this, or whether the current system keeps being good enough for attackers to abuse.
