New Mac password-stealing malware has been caught posing as one of macOS’s most trusted, mundane system components: Apple’s crash reporter. Security researchers at Jamf Threat Labs have named the infostealer CrashStealer, and its whole trick rests on a single moment of misplaced trust — a fake, official-looking prompt that asks you to type in your Mac account password so it can “run diagnostics.” If you do, it goes straight for your saved passwords, keychain and crypto wallets.
Before anyone panics: this is not a “every Mac is infected” event. CrashStealer was aimed at specific individuals through fake job-interview and video-call invites, and Apple has already revoked the credentials that let it slip past macOS’s built-in defenses. But the reason it’s worth your two minutes is the lasting lesson underneath the news, and it’s a rule worth memorizing: Apple’s crash reporter is built into macOS and never asks for your password.
How the Mac password-stealing malware works
Jamf Threat Labs first spotted a suspicious sample on VirusTotal back in May 2026, during what looked like the malware’s development phase, then saw it actively deployed in the wild by early July. The firm published its full technical writeup on July 13, 2026, and coverage spread quickly across the Apple and security press.
CrashStealer is a C++ infostealer that dresses itself up as Apple’s genuine crash-reporting tool. It impersonates the real component’s bundle identifier (com.apple.crashreporter) and even copies its icon and appearance. When it runs, it throws up a native-looking macOS prompt claiming it needs your password and admin access “for diagnostics” or “for system administration” — including full disk access.
That prompt is the entire attack. Type your password in, and CrashStealer uses it to unlock your macOS login keychain and starts harvesting. According to Jamf, it goes after:
- Browser data — saved passwords and cookies from Chromium-based browsers and Firefox.
- Keychain contents — Safari logins, Wi-Fi passwords and cryptographic keys.
- Password manager vaults — Jamf’s writeup cites roughly 14 password manager apps as targets, including 1Password, Bitwarden and LastPass.
- Crypto wallets — over 80 different cryptocurrency wallet browser extensions, including MetaMask, Phantom and Coinbase Wallet.
- Personal files — items from your Documents and Downloads folders, while deliberately skipping large media files to keep the theft quiet.
What it grabs, it encrypts locally with AES-256-GCM before shipping it off to the attacker’s server. That’s unusually strong protection for this class of malware, and it isn’t for your benefit — it makes the stolen data harder to intercept and after-the-fact forensic analysis harder for investigators.
The one rule to remember: the real crash reporter never asks for your password
This is the part worth keeping long after CrashStealer is forgotten. macOS’s actual crash reporter is a system component that runs automatically when an app quits unexpectedly. It offers to send an anonymous report to Apple. It does not need — and never asks for — your account password to do that.
So the moment any app claims it needs your Mac login password “for diagnostics,” “for system administration” or to send a crash report, treat that as a red flag, not a routine request. The same goes for an unfamiliar app that demands full disk access the instant you open it. Legitimate software occasionally needs elevated permissions, but it doesn’t ambush you for your password on first launch under the banner of a system utility.
Who was actually targeted
CrashStealer didn’t spread through mass downloads. It arrived inside a fake video-conferencing app called “Werkbit” — distributed as a disk image (“Werkbit Setup”) containing a Werkbit.app bundle. Crucially, the downloads were gated behind a meeting PIN, which researchers say points to deliberate targeting of specific people, most likely through fake job-interview or video-call meeting invitations rather than broad distribution to the public.
That’s the detail that should calibrate your risk. If you weren’t lured into installing a “meeting app” from a link someone sent you, you were almost certainly never in the blast radius. Jamf noted in a July 14 follow-up that infrastructure tied to the same operation was later seen hosting a different, unrelated stealer — a sign this is one piece of a larger, multi-platform campaign by the same actors, not a one-off.
Notarized does not mean safe
Here’s the uncomfortable part for anyone who treats Apple’s approval as a seal of safety. The Werkbit installer was a validly signed and Apple-notarized package, which let it clear Gatekeeper’s checks with no warning at all. Apple markets notarization and Gatekeeper to users as protection against exactly this kind of thing — yet the malware walked straight through that guarantee using a legitimately signed, notarized Developer ID.
Apple has since revoked the Developer ID credentials used to sign the malicious installer, according to Macworld, which should let Gatekeeper block this specific dropper going forward. That closes the door on this exact sample, but the broader takeaway stands: notarization is a baseline automated check, not proof that an app is trustworthy. “Apple signed off on it” is not the same as “this is safe” — CrashStealer is the proof. If you run macOS day to day (and if you’re eyeing the new features in the macOS 27 Golden Gate public beta, that’s you), it’s worth internalizing that distinction.
How to protect yourself
You don’t need special tools here — just some plain habits that defeat this whole category of trick:
- Never type your Mac password into a “crash report” or “diagnostics” prompt. The real crash reporter never asks for it. If an app does, cancel and quit it.
- Be suspicious of first-launch permission demands. A brand-new app asking for your login password or full disk access the moment you open it — when you didn’t expect it — deserves scrutiny.
- Only install from the Mac App Store or a vendor’s own official website. Be extra wary of apps sent to you directly through a meeting invite, DM or unsolicited link, especially around “job interview” or “video call setup” pretexts, which is exactly the lure used here.
- Don’t equate “notarized” with “safe.” The absence of a Gatekeeper warning is not a guarantee. Judge an app by where it came from and whether you sought it out, not by whether it launched without complaint.
If you’re worried you may have run a suspicious “CrashReporter” or “Werkbit” app and entered your password, act as a precaution: change your Mac login password and any passwords stored in your keychain or password manager, and check your crypto wallet extensions for unauthorized activity.
The honest caveat: this is not a detection or removal guide, because for most users prevention is the whole game. CrashStealer’s power came entirely from someone voluntarily typing a password into a convincing fake — refuse that one prompt and the attack has nowhere to go.
Sources: Jamf Threat Labs, MacRumors, 9to5Mac, BleepingComputer, Macworld
