Researchers warn about a new macOS infostealer called “CrashStealer” that pretends to be Apple’s Crash Reporter. It uses a legitimate-looking installer and a fake macOS-style password prompt to trick users into unlocking Keychain, then steals credentials and crypto wallet data.
CrashStealer is a macOS infostealer that impersonates Apple's Crash Reporter. It uses aliases such as CrashReporter.dmg for installation and CrashReporter.app for the application bundle, paired with a legitimate-looking icon to build false trust. Once running, it presents a fake password prompt styled to look like a genuine macOS authorization request asking the user to unlock Keychain. If the victim enters their password, the malware validates the credentials locally and then uses them to target password managers, browsers, and cryptocurrency wallets. Stolen data is packaged and exfiltrated to an attacker-controlled server in encrypted form.
The main .dmg file is distributed as 'Werkbit Setup,' which packages up CrashReporter.dmg inside a signed and Apple-notarized dropper disguised as a disk image. Because the dropper carries a valid Developer ID and a stapled notarization ticket, it clears Gatekeeper on first launch, so the installer appears to be a legitimate, trustworthy utility with no immediate red flags. This combination of a familiar Apple-related name, a convincing icon, and a notarized package removes the usual visual and technical cues that macOS users rely on to judge software as safe.
Organizations and individual Mac users can reduce risk by treating unexpected password prompts as a stop-and-verify moment: only enter credentials when you personally initiated a known, trusted action. Users should verify the source of any DMG installer before running it and avoid cracked or pirated downloads, which carry a high risk of bundled malware. It is also important to remember that a valid Developer ID and notarization are not proof of safety; signed and notarized installers can still deliver harmful payloads, so trust signals like these should not be relied on alone. Building awareness around these specific behaviors, fake authorization prompts, unusual DMG naming, and unrequested Keychain access, gives users concrete signals to recognize this type of social engineering before credentials are compromised.
This attack pattern maps to techniques including masquerading and credentials from password stores, documented at attack.mitre.org, which security teams can use to inform detection and training priorities.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
CrashStealer is macOS infostealer that impersonates Apple's Crash Reporter, using names like CrashReporter.dmg and CrashReporter.app plus a legitimate-looking icon to trick users into trusting it.
It displays a fake password prompt designed to mimic a genuine macOS authorization request asking to unlock Keychain, and once entered, the credentials are validated locally and used against password managers, browsers, and crypto wallets.
Not reliably. The dropper, distributed as 'Werkbit Setup,' is signed and Apple-notarized, which lets it bypass Gatekeeper warnings on first launch even though it delivers a harmful payload.
Treat any unexpected password prompt as a stop-and-verify moment, verify the source of DMG installers, and avoid cracked or pirated software downloads.
On a Mac and see this? “CrashReporter tries to unlock the keychain” asking for your password, this can be CrashStealer, not Apple. CrashStealer arrives as a disk image like “Werkbit Setup”, which quietly installs “CrashReporter.dmg” and “CrashReporter.app” with an Apple-looking icon, then flashes that fake Keychain prompt to grab your Mac password. Type your password there, and CrashStealer unlocks your Keychain, tests the credentials, then digs into your browser logins, password manager, and crypto wallets before sending it all off in an encrypted bundle. Your move: if a password prompt pops up and you didn’t clearly start that action, stop and close it, don’t type your Mac password, no matter how “Apple” it looks.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
A large review of “AI-enabled malware” found most samples were proof-of-concepts, but a small set were real threats seen in production environments. The real-world activity included trojanized installers that pretended to be legitimate apps (like a recipe app or a Dropbox installer) and relied on…
A researcher was targeted after Black Hat/Def Con by an attacker posing as a CoinDesk executive and using X direct messages to build trust. The scam used familiar platforms (Google Docs and Dropbox DocSend) to push “ClickFix”-style steps or a fake installer intended to get the victim to run malware.
Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled…
Researchers describe AmnesiaStealer, a macOS infostealer spread via a convincing fake GitHub download page that tricks users into pasting a Terminal command. After installation, it uses an “Installer”-style password prompt to capture the Mac login password, steal browser and keychain data, and can…
Cybercriminals sent emails styled like Bank of America that redirected victims to fake pages and pushed a download called “Account Guard.” On Windows, the download installed ScreenConnect remote management software, giving attackers remote control of the device. The campaign used lookalike domains…
