New Mac Malware ‘CrashStealer’ Targets Passwords and Crypto Wallets

A sophisticated new malware strain dubbed ‘CrashStealer’ is targeting Mac users, stealthily pilfering sensitive information including browser credentials, password manager data, and cryptocurrency wallet details. Security researchers at Jamf Threat Labs have identified this threat, which cleverly disguises itself as legitimate Apple software to trick unsuspecting users into compromising their systems.

Understanding the CrashStealer Threat

CrashStealer represents a significant advancement in Mac-specific malware. Unlike many predecessors that relied on simpler scripting languages, this malware is written in native C++, making it more robust and harder to detect. Its developers have also incorporated anti-debugging features, further complicating analysis by security professionals. The malware’s primary objective is to gather valuable personal and financial data, including browser login information, stored passwords, and the contents of cryptocurrency wallets.

A particularly concerning capability of CrashStealer is its ability to access and copy the Mac’s login Keychain, a built-in password management system. Before exfiltrating any collected data, CrashStealer encrypts it using AES-256-GCM, adding another layer of obfuscation. This encryption ensures that even if remnants of the stolen data are found, they remain unreadable without the decryption key.

The Deceptive Installation Process

The infection chain begins not with software named CrashStealer, but with a disk image presented as ‘Werkbit Setup.’ This installer is polished and professional, designed to appear entirely legitimate. Users are instructed to right-click the application and select ‘Open,’ a common workaround for Mac security warnings that often signals potentially risky software.

Crucially, the Werkbit Setup installer was signed with a valid Apple Developer ID and had undergone Apple’s notarization process. This allowed it to bypass macOS’s Gatekeeper security feature on its initial launch, a significant hurdle for malicious software. The distribution method also involved a website that required a meeting PIN, creating a sense of exclusivity and potentially limiting access to pre-selected targets.

Once executed, the Werkbit Setup contacted GitHub for instructions and then downloaded a script from the attackers’ servers. This script subsequently installed a second disk image, named ‘CrashReporter.dmg,’ into a hidden temporary folder. The malware then operated under the guise of ‘CrashReporter,’ using a bundle identifier (‘com.apple.crashreporter’) that closely mimics a genuine Apple system component, aiming to remain undetected.

Bypassing Mac Security Measures

macOS employs Gatekeeper and Developer ID signing to protect users from malicious downloads. The notarization process involves Apple scanning applications for known threats before they are distributed. However, as demonstrated by CrashStealer, these measures are not foolproof. Attackers can exploit the trust placed in notarized software, especially when combined with social engineering tactics.

Jamf Threat Labs noted that the attackers had signed the disk image itself, an unusual step for malicious software, which added to its apparent legitimacy. After identifying the malicious activity, Jamf reported the Developer Team ID associated with Werkbit Setup to Apple.

The Fake Password Prompt

A key feature of CrashStealer is its deceptive password prompt. Once active, the malware displays a window that looks identical to a legitimate macOS authorization request. This prompt is designed to trick users into entering their system password. The malware verifies the password locally using a built-in macOS command. If the password is incorrect, the prompt reappears, maintaining the illusion of a legitimate system check. If the password is correct, CrashStealer captures it, stores an obfuscated copy, and then uses the credential to unlock the user’s login Keychain.

This fake prompt is a critical warning sign. While it may appear convincing, its appearance immediately after installing an unrelated application or joining an online meeting should raise suspicion. Legitimate installers typically do not require administrative passwords to proceed with basic functions.

Data Targeted by CrashStealer

CrashStealer casts a wide net in its search for valuable data. Its targets include:

• Browser Credentials: Information stored in Chromium-based browsers (like Chrome, Edge, Brave), Safari, and Firefox.
• Password Managers: Data from popular managers such as 1Password, Bitwarden, LastPass, and Dashlane.
• Cryptocurrency Wallets: Information from extensions like MetaMask and Phantom, along with approximately 80 other wallet types.
• Login Keychain: The Mac’s native password management system.

The malware also employs a file-searching tool that scans common locations like Documents and Downloads, though it tends to skip large media or installer files, focusing instead on more compact files likely to contain credentials or financial records.

Hiding the Evidence

After gathering the targeted information, CrashStealer stores it in hidden folders within the user’s home directory. Each piece of data is encrypted using AES-256-GCM. The encrypted files are then bundled into hidden ZIP archives before being uploaded to an attacker-controlled server. This encryption not only conceals the data during transit but also ensures that any discovered archives confirm the malware’s activity, even if the contents cannot be immediately deciphered.

To ensure persistence, CrashStealer copies itself into the Mac’s Library cache folder and creates a LaunchAgent. This LaunchAgent is configured to automatically start the malware whenever the user logs in, often using an Apple-like name to blend in with legitimate system processes.

Recognizing and Preventing CrashStealer Infections

Several warning signs can indicate a potential CrashStealer infection:

• Downloading software from a site requiring a meeting PIN.
• An unexpected ‘CrashReporter’ password prompt appearing shortly after installing new software or joining an online meeting.
• An unfamiliar application requesting extensive permissions, such as Full Disk Access or access to Documents and Downloads, under the guise of “system administration.”

To protect against CrashStealer and similar threats, users should adopt the following security practices:

1. Download Apps from Verified Sources: Prioritize the Mac App Store or directly from the developer’s official website. Avoid downloads from meeting links or unsolicited messages unless independently verified.
2. Respect Security Warnings: Be cautious when prompted to bypass Mac security warnings. Only override them if you are absolutely certain of the software’s source and integrity.
3. Scrutinize Password Prompts: Always check which application is requesting your password and why. Cancel requests that seem out of context and verify the legitimacy of the software through a separate channel.
4. Review App Permissions: Regularly check System Settings > Privacy & Security for unusual requests for Full Disk Access, Files & Folders, or Accessibility. Disable permissions for unrecognized applications.
5. Manage Login Items: In System Settings > General > Login Items & Extensions, review applications set to open at login or run in the background. Remove any suspicious entries.
6. Keep macOS Updated: Install all available macOS security updates promptly, as they often contain critical patches for newly discovered vulnerabilities.
7. Use Reputable Antivirus Software: Install and maintain a trustworthy antivirus program on your Mac, ensuring real-time protection is enabled and the software is regularly updated.

Immediate Actions if Infected

If you suspect you have installed Werkbit Setup or encountered CrashStealer:

• Immediately disconnect the Mac from the internet to prevent further data exfiltration.
• Do not enter any further passwords on the affected computer.
• Run a comprehensive scan with your security software.
• Contact Apple Support or your IT department for assistance.
• Using a separate, clean device, change passwords for your Apple Account, primary email, password manager, and any sensitive online accounts (banking, shopping).
• Enable Two-Factor Authentication (2FA) wherever possible.
• If you used cryptocurrency wallets on the infected Mac, treat your private keys and recovery phrases as compromised. Move any remaining funds to new wallets created on a clean device and never reuse the old recovery phrase.
• Consider a full system erase and macOS reinstallation if security software cannot confirm complete removal of the malware. Restore personal files carefully from a known clean backup.

CrashStealer highlights the evolving tactics of cybercriminals targeting the Mac ecosystem. By combining sophisticated malware with convincing social engineering, attackers aim to exploit user trust. Vigilance in verifying software sources, scrutinizing security prompts, and maintaining robust security practices are essential defenses.