Jamf Threat Labs has identified a new macOS infostealer dubbed CrashStealer that operates by masquerading as Apple's legitimate crash-reporting tool to exfiltrate passwords, Keychain data, and cryptocurrency wallets. The malware, first observed in development in May, has progressed to active in-the-wild use as of early July, distinguishing itself from common commodity stealers by its more sophisticated implementation.
Jamf Threat Labs has uncovered a new macOS infostealer named CrashStealer that disguises itself as Apple’s crash-reporting tool to steal passwords, Keychain data, and cryptocurrency wallets. The malware was first spotted in May while it was still under development. By early July, Jamf was seeing in-the-wild detections, indicating it had moved into active use. “Unlike much of the commodity stealer activity on macOS, which is built on AppleScript droppers or thin Objective-C wrappers, CrashStealer is … More → The post New macOS malware steals passwords by posing as Apple’s crash-reporting tool appeared first on Help Net Security .