New Mac Malware 'CrashStealer' Caught Stealing Crypto Wallets

New Mac malware targets cryptocurrency wallets and passwords. Security firm Jamf Threat Labs has identified actual attacks by 'CrashStealer,' which impersonates Apple's crash reporting program to steal crypto wallets and keychains (password repositories). Researchers have been tracking this malware since May 2026.

The malware bypasses Apple's security defenses via a 'Werkbit Setup' installer file, which possesses a valid Apple developer certificate and notarization ticket. CrashStealer poses a high technical risk as it is written in native C++ rather than a common script. It features anti-debugging capabilities to hinder analysis and encrypted data transmission technology, stealing browser credentials, password manager data, cryptocurrency wallet information, and Mac login keychains.

Consequently, users are advised to exercise caution regarding the execution of installers from unclear sources and requests to enter passwords on fake prompts.