# New CrashStealer malware poses as Apple crash reporting tool

> **Open Intelligence Dossier** · First detected: 2026-07-14 12:07 UTC · Category: Technology

## Executive Summary
A new malware strain called CrashStealer is impersonating Apple crash reporting tools to bypass security and steal sensitive user credentials on macOS.

## Intelligence Brief
A new piece of malware known as CrashStealer is targeting macOS users by masquerading as an official Apple crash reporting tool. According to reports from BleepingComputer, AppleInsider, and Macworld, the malware is designed to deceive users into thinking a system crash has occurred, allowing the software to infiltrate the system. Once active, CrashStealer focuses on the theft of highly sensitive information, specifically targeting password vaults and cryptocurrency wallets. Coverage from 9to5Mac emphasizes that the malware is specifically designed to steal passwords and crypto wallet data from infected Mac computers. The Hacker News and Security Affairs report that CrashStealer utilizes a notarized dropper to pass Gatekeeper checks, which are the standard security protocols Apple uses to ensure software is safe.


Forbes further specifies that this technique allowed the password stealer to bypass the macOS Gatekeeper without triggering a warning to the user. Broadcom and HotHardware also confirm that the malware mimics a crash reporter to hijack Mac systems, illustrating a coordinated effort to mislead users through a fake interface. This trend is particularly significant due to the scale and method of delivery described in the coverage. While the primary focus is on CrashStealer, CyberSecurityNews reports on the broader landscape of macOS threats, mentioning Odyssey Stealer, which has impacted users in over 100 countries and targets 300 different cryptocurrency wallet extensions. This context suggests a growing trend of specialized infostealers targeting Mac users.


The use of signed apps and notarized installers, as mentioned by LinkedIn and Security Affairs, represents a critical escalation because it leverages Apple's own trust mechanisms to evade detection and gain unauthorized access to user data. Future developments to monitor involve how Apple and security vendors respond to the use of notarized droppers for malicious purposes. Current coverage from BleepingComputer and The Hacker News indicates that the core of the threat lies in the malware's ability to appear legitimate during the installation phase. Users are advised by 9to5Mac and Macworld to be wary of unexpected crash reports that prompt the installation of software. The industry will likely watch for updates on whether the signed certificates used by CrashStealer are revoked and if new Gatekeeper updates are deployed to prevent similar impersonations of Apple system tools.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| SOC Prime | CrashStealer Poses as a macOS Crash Reporter | [Source Link](https://news.google.com/rss/articles/CBMiogFBVV95cUxNbTVGaWQtVnBSek5RYURKMEcwNlYtaG9WdEwyaXNjWklLQy12V0wtLTdyNVVtTEd4eE9uSm8yTVVHc3BiaGY5TGg5eDJJQXdQRjRZQXoxRVlMeUttU1FuVXdNZmM1Slo2eWF0dkVXUG1yUWhLdkRtTUlqX3NQQVI3c0F2emlRVklJQnlPZnZnMHBuTTRzN1JfNDdUa2FRMFVPRWc?oc=5) |
| 9to5Mac | PSA: Beware of fake Mac crash reports out to steal your passwords, crypto wallets, more | [Source Link](https://news.google.com/rss/articles/CBMitwFBVV95cUxQLVNmdW11azZLRGFTbUhrSXZGTnFUWVIwV3QxYUdfNEtPbFk2bC1BQ09BVldSLUxsanh3UUVHYy15U1JSeWh3MkRvZlNMdEVjN3JRSWFBSUcwb1N2UmZlbVV0MVRyM00xMkVMMEdOU3l4Qzc0a2M2YlV4VzFrQzRkTTNRNy1uZDJJbFFVMGVkMnVWcjlWSTZQaVhXV1dMUElNVWJrUXZhbEhaN19maFJFNDFhMzZIcG8?oc=5) |
| SC Media | MacOS ‘CrashStealer’ malware poses as crash reporter to steal credentials | [Source Link](https://news.google.com/rss/articles/CBMiogFBVV95cUxNTTFqaVZrTDhkM2d6a1c0ckF5WXV4aDVGemZjTHVST3MwVzJTc2FzQmx3LUVXRkNfbjBMbFhlcDJfNTJlaGZjTGJ6d3N0MHI0YjQ4RG95cGoxSlRpN2QtRWNIN3BueGY0alFrTEFpSzVwalVfeXNZaGtiYjZRQmpzZF9qR2ZvMlgyb2lRSGU0T1VUNUl1bVF3QzZhcjBfa0dxYkE?oc=5) |
| Security Boulevard | This fake Apple app can unlock your Mac’s password vault | [Source Link](https://news.google.com/rss/articles/CBMimgFBVV95cUxQV1BDQWk5a3p3czhKT0xyc21CcnMydGtrVHFpdHNmQTI4NWcyZlpGenhJV2k0SHIwd2wyaGhrQy0wTFA4eDk4T2J1M1ZWaDV2bXVDVG5WQlkzR2NaSmlqd1JQRnF3eGlvRTAydXhTWmcwYUV5OU1vS2c3eDdrVnpCTE5aRTlHVGV0bktMeTJIanpiYmRkb3dFLVV3?oc=5) |
| Broadcom | CrashStealer Malware Targets macOS Users via Mimicked Crash Reporter | [Source Link](https://news.google.com/rss/articles/CBMi0wFBVV95cUxNd1dFamNKWG9pNzlfbmhYUEVKMWhqaEpTTGVKeUhJY19td1IyWkx5WlJWNXhldG52VG40TGVtTVdtZktWQmd2TVYwZ3g4ek43M2h3ZS14Y0pIdmVMRm13Ykh0VWtHS2lRaDhTZ3BwSVBvUFN3RUVWMXJiMDA0Vi1ua3pTbUxqNVN4SFQxOHF3RjR5aXh2RU80dXZ0bER3YWU5TFR4TlJMcDhPWVdXOXkxWTJfN3RUb212UlZrWjRVZzlXdE1zR0g3a0l1eTlLc21jZG1j?oc=5) |
| CyberSecurityNews | Odyssey Stealer Hits macOS Users in 100+ Countries, Targets 300 Crypto Wallet Extensions | [Source Link](https://news.google.com/rss/articles/CBMicEFVX3lxTE1zYTRycWtIZzBQeFY0TmhoR1c0QmxEZFpTRFJyYXNJSkJHbFQtdWRtT3lEaEZ0TGFZYXFGaUJ4dEVPOWdaVG9ONVI4U2I4RndnaEdfdjY4dlRkNHNCdUwzdl9lR3JoSXFiUDJzelZrembSAXZBVV95cUxNRFNYUVBlekRHaC1XdkpvcWFTVXNoTEM0dmI5WXQ3WUkwOElZdlNET2w1S3VCNnhIQWNwVjhPR2Nwd1NQdEdqaXlDNnBxeHgzVE5CYkkzMENuNXFwVW91TVprcURqOUpieWFGeFd5cGtBT015VGhn?oc=5) |
| HotHardware | CrashStealer Malware Poses As Apple Crash Reporter To Hijack Macs | [Source Link](https://news.google.com/rss/articles/CBMibkFVX3lxTFB1VFN4aVFMeGNRelBEcVo5UEhVZVdHWmdMSzljUDdnOHhVWi1pS2NINnZId3N0RGpDYjNDWWFKWXlLQmhHeXR3QXFmZUZ5bkJOTlB1enlWX0Q4MXV2bkFLdTRXWTBMRXR0YWNkaXh3?oc=5) |
| LinkedIn | WARNING: New macOS Malware Impersonates Apple's Notarized Installer | [Source Link](https://news.google.com/rss/articles/CBMilwFBVV95cUxOWk9Ya1Uxb0pDaUkxaHFMRDdoQVJDN2JnWWM2LVIwTWZEb2VRX3ZEM1c1aGJUOTRDelhkMzhLVFl2VllOUU1RdTNsS1hMXzFVLXo5bHhkdUY4d192NVNsWklEXzdTcVh2SlZTODE5cGgtSzIzMlc1SlZRSERCZm1JMFBrbWkxVzZZcEs0QTZ6Qk41aDh3N3Vv?oc=5) |
| Macworld | Watch out: New ‘CrashStealer’ Mac malware could nab your passwords | [Source Link](https://news.google.com/rss/articles/CBMirgFBVV95cUxQODNGUXpGMXNvMWczSFRaMVdyM0kyVElHZGJDQTFBaU1GZ0hBcXcyWFJrMTlURmNnLU1xbUszdFk2VDh6VmdMUS1pRDBudW90M3hDX0xBT0V5bThlMnpNZEN3STFKUTVzWTZPUjRTdktOVkwwd2JBbFh5ZGxFdkwtMF83NTNGOUtGUHh6WFk5ekNEeE43TG9UVGk2TFpkNTRkcF9za2N2ZGp2ZE5TQXc?oc=5) |
| Security Affairs | CrashStealer: New macOS Infostealer Uses Signed Apps to Evade Gatekeeper | [Source Link](https://news.google.com/rss/articles/CBMiuwFBVV95cUxONXI0Rk9hOGU4UTNrOGFYVDJKdno5WTRqVEZxV0tpUUttNTRxc21vTlc5UzhIbG5uTFBZRGE0eFJMdFI5ckw4R0JwT1BUNWx5MEQ3OWluVlN3SzJrb0w2UXN1UHZVUGg3YVc5bmtsSDRsMk41cTQwWjhraDN6THBTODZBbWVkbnMxNWtZdjhneW5hcTRWaU9kMXQ4dXozMWxGVllSZHJGUnFMVUFFdFNCaW1HRzFiX3FNQTlj0gHAAUFVX3lxTFBQa01ZVWt2VHR3RDJYYmF5N0UtWG9LeGNBVllfQVpUeUNNa2xNbGdsYjZCOHZfS1loSjdQaTMtRUd4TWhBbExrVTV5bFlEQjlsWkNGRUU3RS1NTFJEeWNoUEYzc0JqWThDRC1qengtOG5ybkFDY185MjJSdWI2dkR3dTRiU18wa2Y1N1hGajZRYVRkOHQzYml) |
| AppleInsider | 'CrashStealer' malware poses as an Apple tool to steal passwords & Mac data | [Source Link](https://news.google.com/rss/articles/CBMitAFBVV95cUxQU050dXJhVk51LWdBT2RKaEZjbndkR2hXLUUwa19VMzYzUmtsbW1UZndwbEZkSkZ3OW9yRDU2Qkw1X1FWNVJ3WGRfNzk5Q0lYTkdvWXQ0X1dTRnNqTC1SbUE3OXFjVjczcml1b1o4a2x6ZDl2VXZXWWl3YWZPbWY0am9HbjZNaU1OdnVoMTdIbndGNkxWREJkUkotc2dPLW94RGxqckJXR19xdTliUVlJTHcwaG4?oc=5) |
| Forbes | New Apple Password Stealer Bypassed MacOS Gatekeeper Without Warning | [Source Link](https://news.google.com/rss/articles/CBMivgFBVV95cUxNenpVQU5ZV2cxOGhXV0M3YmxJSTlnYlo4N0VVcTdvSEZUQXhHSkNSMWNyOXhkS1NfRFNyREVIM2g3QTRjcHNEUkhwVVZ4aHVPNjNJOWZnc0o5NjdKek53WFc1Wjc4UW5kdE51WXFrcVo0dG1LdFJVa0pBWWJIcWl2aGx6Z3RoV1FId1M4VTlrNXMxWFl4MlB6MlBHT2w1QnNVWDJiblZjVUh6UTZWMlZEZTJXSldVME5QbkhkNWh3?oc=5) |
| The Hacker News | CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks | [Source Link](https://news.google.com/rss/articles/CBMiekFVX3lxTE5Na3VWcFJRa2M3a0pQUEhhalZUWkRXb0NUVU9SeVdONmtmU0g0bVl6SkV5dDhVSGF5b3VZRUVoUi1SRGtsZDVkekhmTXJJOUliZnZiVE9zXzVraEd5bE9ES2NDd3c1SzVpRUcxWGRhOS1LRDZGYnhBYjdB?oc=5) |
| BleepingComputer | New CrashStealer malware poses as Apple crash reporting tool | [Source Link](https://news.google.com/rss/articles/CBMirAFBVV95cUxPenlyN2hOUWs2XzYybWYyQlNiTUQ0Q0tTYmgxVmhLVkczNGd5WVNqZWFLWXNXcW9wRzI5cjJJb2duUHVRRjRvV09mRmRCbTNkVmNLRkVlcnJlRm93NkxmVzR5R0I5VXI1ZktTWmhhR19PZVdHODh0YnpySk4zNDZxaHF6VHZybjVQTjBLOVdoR2VaUE1FTXNyUjBIZDNyVTJhWndMZzFkY0t2UmtP0gGyAUFVX3lxTE5aVENHcGRKei14VEktTy05akZKMWtsRFpQSkphZXE1M1BDajVHRTZvVW9fY0plUWZmeDlJdFp1aFNLNDN5aDdjNklPd0JLc1h3dWNpVXRSODBOYVlxNjB3M3Jja2xhNnFNNlVSNmUzWklnWWZTeDJoRzlVX3JZRVg1dkZFMENzd3hPWmtVRkRZSlFUZFU0blF6WHgweDBPVHBLTEIyTF9) |

---
*Canonical Source: https://pulse.byoviral.com/trend/2026-07-14/new-crashstealer-malware-poses-as-apple-crash-reporting-tool*