CrashStealer Malware Impersonates Apple Tool to Steal Mac Passwords and Crypto

A new stealthy stealer malware targeting macOS users has been identified, operating under the names ClickLock and CrashStealer. According to reports from MacRumors and ZDNET, the malware masquerades as an official Apple crash reporter tool to deceive victims. The primary method of infection involves social engineering, where users are prompted to copy and paste a specific text string into their macOS Terminal, as detailed by The Register. Once the system is compromised, the malware focuses on stealing sensitive data, specifically targeting user passwords and cryptocurrency assets. Coverage from The Hacker News and Group-IB emphasizes the aggressive and unique behavior of the ClickLock stealer. The malware employs a tactic where it kills active applications every 210 milliseconds.

This disruptive cycle continues relentlessly until the victim types their password, creating a sense of urgency or system instability to force the user into providing credentials. Cybernews notes that this specific stealer is particularly stealthy because it requires no exploits to function, relying instead on user action to gain a foothold in the system. This threat is significant because it bypasses traditional exploit-based detection by utilizing the Terminal, a powerful system tool. By impersonating a legitimate Apple utility, the malware leverages user trust in the operating system's native crash reporting mechanisms. Group-IB describes the risk in stark terms, suggesting that a single act of pasting the malicious string can lead to a total loss of assets. This highlights a shift toward social engineering where the user is tricked into granting the malware permissions that would otherwise be blocked by macOS security layers.

Looking forward, users are advised to be cautious of instructions requiring the use of the Terminal for unexpected system fixes. ZDNET has highlighted three specific ways to dodge the threat, though the exact technical steps are contained within their full reporting. Security analysts will likely monitor for variations of the ClickLock and CrashStealer code as it attempts to evade detection. Future updates will depend on whether new delivery vectors are identified beyond the current text-string pasting method documented by the reporting outlets.