CrashStealer Malware Hits Macs, Targets Crypto Wallets and Passwords

A new macOS infostealer called CrashStealer impersonates Apple's built-in crash reporter to drain browser-based crypto wallets and password managers, security researchers at Jamf Threat Labs said.

The malware was first spotted in development during May 2026. By early July, active attacks were underway, roughly six weeks from prototype to deployment, Jamf said.

CrashStealer uses a notarized dropper called Werkbit.app, signed under Developer ID Emil Grigorov, to slip past Apple's Gatekeeper protections. Once inside, it hides in a /tmp directory and establishes persistence through a LaunchAgent, surviving reboots and running quietly in the background. The bundle ID it uses is com.apple.crashreporter – Apple's own identifier for crash-reporting software. To an average user checking system processes, the malware looks routine.

From there, the malware targets browser credentials, macOS Keychain secrets, and data stored by roughly 14 password managers. It can also unlock the Keychain and perform local password validation, meaning it can verify stolen credentials rather than just collect them, Jamf said. All stolen data is encrypted with AES-GCM before transmission, then exfiltrated to attacker-controlled servers via libcurl.

CrashStealer's scope includes around 80 cryptocurrency wallet browser extensions. Browser-based wallets are a persistent weak point in crypto security. A hardware wallet stored offline is immune to this kind of theft. A browser extension wallet is not – the seed phrase or private key often lives in the browser's local storage or memory, and any sufficiently capable infostealer that can read that data can effectively empty the wallet without alerting the owner.

What makes CrashStealer notable is the combination of Gatekeeper bypass via a signed certificate, impersonation of a native Apple process, and the breadth of targeting across both wallets and password managers, the researchers said. The malware's ability to target 14 password managers simultaneously is particularly relevant for anyone using a password manager to store exchange API keys, recovery phrases, or two-factor backup codes. Password managers become a single point of failure if the machine running them is compromised at the operating system level.

The signed dropper angle is worth watching as a broader trend. Obtaining legitimate developer certificates and using them for malware delivery is a tactic that raises the detection bar significantly, Jamf said. Traditional security advice to trust notarized Mac software provides less protection when the notarized software is itself the threat vector.

Jamf reported the misuse of the Developer ID to Apple for further investigation. The company did not disclose how many machines have been infected so far.

For crypto users on macOS, browser-based wallets should be treated as hot wallets in the riskiest sense. Significant holdings belong on hardware wallets. Seed phrases belong written on paper, stored offline, and nowhere near a browser, a password manager, or a machine connected to the internet. Any macOS security tool that flags unexpected use of com.apple.crashreporter bundle identifiers should treat that as an immediate red flag, the researchers said.