Michael Tsai - Blog - CrashStealer Wednesday, July 22, 2026 CrashStealer Thijs Xhaflaire (via Ric Ford): Jamf Threat
Labs discovers and investigates CrashStealer, a C++ macOS infostealer that impersonates Apple's crash-reporting
framework to harvest browser credentials, cryptocurrency wallets and keychain data, encrypting stolen files with AES-GCM
before exfiltrating them to a remote command-and-control server. […] Unlike the payload it eventually installs,
the dropper is properly code signed and notarized: it is a universal (arm64 and x86_64) binary signed with the Developer
ID Emil Grigorov (WWB7JA7AQV), has hardened runtime enabled, and carries a stapled notarization ticket. Notably, the
disk image itself is signed as well, not just the application inside it, which is uncommon in malicious DMG delivery
where the container is typically left unsigned. […] That file supplies the curl command the dropper runs next.
Staging the first hop on a trusted developer domain keeps the initial network activity inconspicuous. […] [The
script] clears extended attributes on the staged bundle with xattr -cr, makes the inner binary executable, strips the
payload's existing signature and re-signs it ad-hoc (codesign --remove-signature followed by codesign -s - --force
--deep --no-strict), registers it with Launch Services via lsregister -f, and finally launches it in the background with
open -g -n. Previously: Notarized Mac App That Downloads Malware Fake Mac Apps on GitHub Notarized Atomic Stealer (AMOS)
More Notarized Mac Malware App Transport Security Code Signing Crash Reporter Gatekeeper Mac macOS Tahoe 26 Malware
Notarization Security Comments RSS · Twitter · Mastodon Leave a Comment Name E-mail (will not be
published) Web site Δ ← → Blog Archives Tag Cloud Top Posts Recently Updated RSS Feed ·
Comments Mastodon · Twitter Apple News Support this site via Patreon. Try my Mac apps: DropDMG EagleFiler
SpamSieve ToothFairy Copyright © 2000–2026 Michael Tsai.