Jamf Threat Labs uncovered CrashStealer, an information-stealing malware for macOS that used a signed Werkbit Setup installer and a fake CrashReporter-style authorization prompt to harvest passwords, Keychain entries and cryptocurrency wallets. Jamf first observed development activity in May 2026 and documented active attacks by July 2026, according to its report.
This explainer summarizes Jamf’s findings, breaks down how the installer and payload worked, lists reliable signs of compromise, and provides a clear, actionable remediation checklist so individuals and administrators can respond quickly.
CrashStealer at a glance
According to Jamf Threat Labs, CrashStealer began appearing in May 2026 and escalated into observed campaigns by July 2026. The authors wrote that the stealer is a native C++ program designed to focus on high-value credential stores on macOS.
The initial delivery used a disk image labeled Werkbit Setup that carried a valid Apple Developer ID and a notarization ticket, allowing it to pass Gatekeeper checks on first launch. A first-stage component fetched a secondary payload from attacker-controlled infrastructure and executed that payload with a name and bundle identifier designed to resemble an Apple system process.
How the Werkbit Setup installer worked
Jamf’s analysis shows the delivery chain began with a signed disk image (Werkbit Setup). The notarization and signing are notable because notarization alone is not a guarantee of safety; attackers can sometimes use legitimate signing to lower user suspicion.
On execution, the installer reached out to GitHub-hosted resources for initial commands, then downloaded and executed a script that staged a second disk image named CrashReporter.dmg into a hidden temporary folder. That second-stage payload used the app name CrashReporter and the bundle identifier com.apple.crashreporter to impersonate an Apple system component.
The distributor also used an access mechanism — for example, a meeting link requiring a PIN — which may have limited exposure and made the download look legitimate to targets.
What CrashStealer steals and how it collects data
CrashStealer prompts the user for their login password using a fake macOS authorization dialog. If the entered password is valid, the malware stores an obfuscated copy and uses the credential to unlock the user login Keychain, then copies the Keychain database into its collection staging folder.
Jamf observed the stealer scanning for browser credentials and wallet data across Chromium-based browsers, Safari and Firefox. The payload looks for a long list of wallet extensions and password managers — Jamf reported targeting around 80 crypto wallet extensions and roughly 14 password managers in the sample it analyzed, and named common targets such as MetaMask and Phantom.
Collected items are packaged into hidden archives and encrypted before exfiltration: Jamf notes the use of AES-256-GCM for confidentiality and integrity of the stolen data. The payload also includes anti-debugging and filtering logic to avoid detection and to prioritize credential-bearing files.
How to spot the fake CrashReporter prompt and installer clues
The most obvious warning sign is an unexpected authorization prompt that resembles CrashReporter or system dialogs but appears at an unusual moment — for example, immediately after opening a meeting link or unrelated download.
Other red flags to watch for:
- An installer asking you to right-click and choose Open to bypass Gatekeeper without a clear, trusted reason.
- A disk image or installer that appears notarized but was delivered via a meeting link or other unverified channel.
- Hidden files or directories named CrashReporter or LaunchAgent entries using Apple-like names in ~/Library or ~/Library/LaunchAgents.
- New Full Disk Access, Files & Folders, or Accessibility permissions granted to unfamiliar apps immediately after an install.
- Unexplained background network activity to unknown servers after running a new installer.
Malware can target browser wallets and Keychain on Macs, so treat any unexpected prompts or permission changes as potential compromise indicators.
How to respond and protect your Mac right now
If you suspect CrashStealer on a Mac, isolate the machine immediately: disconnect it from the network and avoid entering passwords until the system is verified clean. Use a separate, known-clean device to change credentials.
What you should do now
- Disconnect the Mac from the internet and unplug external drives to stop ongoing exfiltration.
- Use a clean device to change Apple ID, email and other critical account passwords; enable two-factor authentication everywhere possible.
- Change master passwords for password managers on a clean device and create new recovery phrases for wallets on a secure machine; assume wallet secrets on the affected Mac are compromised.
- Check System Settings > Privacy & Security and revoke unexpected Full Disk Access, Files & Folders or Accessibility permissions for unknown apps.
- Inspect ~/Library/LaunchAgents and other startup folders for suspicious LaunchAgent files; remove only if confident, otherwise consult an expert.
- Run a full scan with trusted macOS endpoint protection or AV tools; collect logs and consult your IT/security team for forensic analysis if available.
- If a reliable cleanup cannot be confirmed, erase the Mac and reinstall macOS from a trusted installer, restoring data from backups made prior to the suspected infection.
- For cryptocurrency wallets, move funds from affected addresses to new wallets created on a clean device and never reuse old recovery phrases.
Jamf reported the Developer Team ID associated with the Werkbit Setup signing to Apple during its investigation; Apple may revoke abused certificates if abuse is confirmed. The Jamf report did not attempt to quantify total infections, and it did not specify an overall victim count for this campaign.
Key takeaways
CrashStealer illustrates how signed and notarized installers can still be abused to deliver credential-stealing malware. The critical behavior to watch for is an unexpected CrashReporter-style password prompt or an installer that asks you to bypass Gatekeeper. Verify all installers, avoid downloading software from unverified meeting links, and keep macOS and security software up to date.
What comes next
Jamf Threat Labs continues to monitor variants and distribution methods. Apple and security vendors may update detections and revoke signing assets as investigations progress. Administrators should watch for advisories from Jamf, Apple and their endpoint vendors.
Sources and attribution
This article is based on the technical analysis published by Jamf Threat Labs and reporting by Fox News. For full technical details, see Jamf Threat Labs’ analysis and the Fox News coverage linked below. The Jamf report is the primary source for the technical breakdown; the Fox News article provides reporting context. The Jamf Threat Labs analysis did not provide a total infection count.
Fox News coverage: https://www.foxnews.com/tech/crashstealer-mac-malware-steals-passwords-wallets
Jamf: https://www.jamf.com
