January 1, EXPOSED: Sinister Mac Malware Draining Crypto Wallets Across America

Wyatt’s Take

• Brand-new Mac malware is posing as legitimate Apple crash reporting software to steal your passwords, crypto wallets, and personal files — and it’s slipping right past Apple’s security checks.
• The attack starts with a professional-looking installer that tricks users into entering their Mac password, then quietly copies everything from browser credentials to cryptocurrency wallet data.
• This isn’t some amateur hack — the malware encrypts stolen files and uses Apple’s own security systems against you, proving Big Tech’s security theater can’t protect working Americans.

A polished installer can make dangerous software feel routine. You see a familiar Mac window, follow the directions, and enter your password when asked. By then, the app may already be working against you.

Security researchers at Jamf Threat Labs have uncovered CrashStealer, a new Mac information stealer that impersonates Apple’s crash-reporting software. Jamf first tracked the malware in May 2026 while it appeared to be under development. By early July, researchers detected it in active attacks.

CrashStealer targets information many people rely on every day. It searches for browser credentials, password-manager data, and cryptocurrency wallet information. The malware can copy the Mac login Keychain as well.

The malware stands out because its developers wrote it in native C++. Many common Mac stealers rely on AppleScript or simpler software wrappers. CrashStealer also encrypts the files it collects before sending them to an attacker-controlled server.

Meanwhile, anti-debugging features make the malware harder for researchers to examine. However, the first app a victim sees isn’t called CrashStealer. The attack begins with a disk image branded as “Werkbit Setup.”

The Werkbit Setup disk image contains a polished installer. Its directions tell the user to right-click the app and choose Open. That action often appears in instructions for software that needs to get around a Mac security warning.

In this case, the installer already carried a valid Apple Developer ID and a notarization ticket. Therefore, it could clear Gatekeeper on its first launch. Jamf also found that the disk image itself had been signed, which researchers called unusual for malicious Mac delivery.

The website that distributed Werkbit Setup required a meeting PIN. That setup may have helped the attackers limit access to people who received the correct code. It also made the download feel more exclusive and potentially more believable.

Once opened, Werkbit Setup contacted GitHub for an initial command. It then downloaded a script from the attackers’ infrastructure. Next, the script installed a second disk image named CrashReporter.dmg in a hidden temporary folder.

The payload used the name CrashReporter and the bundle identifier com.apple.crashreporter. Those details were chosen to resemble an Apple system component. The malware then launched quietly in the background.

Apple uses Gatekeeper alongside Developer ID signing to reduce the risk from downloaded software. Its notarization process checks an app for known malicious content when developers submit it. Gatekeeper can also check whether Apple has revoked the signing certificate.

Still, a notarized label should never replace your judgment about where an app came from. A harmful app can slip through before researchers or Apple identify its behavior. Attackers can also use a trusted first-stage installer to retrieve a different payload after launch.

Jamf reported the Developer Team ID connected to Werkbit Setup to Apple after confirming that it had distributed malicious software. The report did not say how many people had been infected.

After CrashStealer launches, it displays a password prompt designed to resemble a legitimate macOS authorization request. The malware checks the password locally with a built-in Mac directory service command.

If the password is wrong, the prompt returns. If it is correct, CrashStealer stores an obfuscated copy and uses the credential to unlock the login Keychain. The malware can then copy the Keychain database into its collection folder.

That makes the prompt one of the most important warning signs. A password request can look convincing, yet the timing may feel wrong. An online meeting installer should not need your Mac password to display a call or download ordinary content.

CrashStealer searches broadly across the Mac. Jamf found code and activity tied to Chromium-based browsers, Safari data, and Firefox credential files. The malware also checked wallet extensions such as MetaMask and Phantom.

In addition, it targeted password managers that included 1Password, Bitwarden, LastPass, and Dashlane. Jamf observed roughly 80 cryptocurrency wallet extensions and 14 password managers in the target list.

A separate file-search tool scans locations such as Documents and Downloads. However, it skips many large installers, apps, and media files. That filtering suggests the thieves want compact files that may contain credentials or financial records.

Other personal documents may also appeal to the attackers. CrashStealer stores stolen material inside hidden folders under the user’s home directory. It encrypts each collected item with AES-256-GCM.

Then it packages groups of encrypted files into hidden ZIP archives before uploading them. Encryption helps the attackers conceal the contents of the stolen files while they sit on the Mac. It also means a leftover archive can confirm that collection occurred even when an investigator cannot read the data inside it.

The malware then copies itself into the Mac’s Library cache folder. It creates a LaunchAgent that starts the copied app when the user logs in. The LaunchAgent uses an Apple-like name, which can make the entry blend in during a quick inspection.

You may have encountered this campaign after downloading Werkbit Setup. The risk rises if the website required a meeting PIN. An unexpected CrashReporter password prompt is another red flag.

Be more suspicious when the prompt appears right after installing unrelated software or joining an online meeting. Also, watch for an unfamiliar app asking for Full Disk Access or permission to reach Documents and Downloads.

CrashStealer’s configuration included permission messages designed to make broad file access sound necessary for “system administration.” Security teams can also look for the hidden CrashReporter locations and LaunchAgent described in Jamf’s technical report. However, most home users should avoid digging through system folders unless they know exactly what they are changing.

A few careful habits can help you spot a suspicious Mac installer before it gets access to your passwords and personal files. Use the Mac App Store when possible.

Otherwise, type the developer’s official website address yourself. Avoid downloading software from a meeting link, private message, or unexpected pop-up unless you can independently confirm the source.

Be wary when an installer tells you to right-click and choose Open or use the Open Anyway button. Apple recommends overriding a security warning only when you trust the app’s source. You should also confirm that nobody altered the download.

Look at which app triggered the prompt and why it needs authorization. Cancel the request when the reason does not match what you are doing. Then close the app and verify the download with the company through a separate channel.

Open the Apple menu, then System Settings, then Privacy & Security. Review Full Disk Access, Files & Folders, and Accessibility for apps you do not recognize. Turn off access for anything suspicious.

Next, open System Settings, then General, then Login Items & Extensions. Review the apps listed under Open at Login and Allow in the Background. Remove or disable unfamiliar entries.

You can also check System Settings, then General, then Device Management for profiles you do not recognize. This option may appear only when a profile is installed. Do not remove a work or school profile without contacting the administrator first.

Open the Apple menu, then System Settings, then General, then Software Update. Install available updates promptly because they include current security protections.

A trusted antivirus program can help detect known malicious files, suspicious persistence, and harmful network behavior. Keep real-time protection enabled and allow the software to update automatically. Jamf says threat-prevention tools can help block and report similar Mac threats.

Disconnect the Mac from the internet. Do not enter another password on that computer. Run a full scan with trusted security software.

You should also contact Apple Support or your workplace IT team. Next, use a clean device to change the password for your Apple Account, primary email account, and password manager.

Change passwords for banking, shopping, and other sensitive accounts that were saved on the affected Mac. Enable two-factor authentication where available and sign out of devices or active sessions you do not recognize.

After the Mac has been cleaned, change its login password because CrashStealer may have captured and validated that credential. If you use cryptocurrency wallets on the affected Mac, treat their private keys and recovery phrases as exposed.

Move remaining funds to newly created wallets from a clean device. Never reuse the old recovery phrase. If security software cannot confirm that CrashStealer has been fully removed, contact Apple Support or a qualified technician about erasing the Mac and reinstalling macOS.

Restore personal files carefully from a backup created before the infection, when possible.

Wyatt Matters

CrashStealer shows how criminals can wrap harmful software in a convincing Mac experience. The signed Werkbit installer gave the campaign a layer of credibility. Then the fake crash reporter used a familiar password prompt to reach valuable data on the computer. Your best defense begins before the password prompt appears. Verify the source of every installer and stop when the instructions ask you to bypass a warning. This is another reminder that Big Tech companies like Apple charge premium prices while leaving working families vulnerable to digital thieves. Real security comes from staying alert, not trusting billion-dollar corporations to protect what’s yours.