{"id":52682,"date":"2026-07-22T16:34:18","date_gmt":"2026-07-22T20:34:18","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=52682"},"modified":"2026-07-22T16:34:18","modified_gmt":"2026-07-22T20:34:18","slug":"crashstealer","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2026\/07\/22\/crashstealer\/","title":{"rendered":"CrashStealer"},"content":{"rendered":"

Thijs Xhaflaire<\/a> (via Ric Ford<\/a>):<\/p>\n

\n

Jamf Threat Labs discovers and investigates CrashStealer, a C++ macOS infostealer that impersonates Apple's crash-reporting framework to harvest browser credentials, cryptocurrency wallets and keychain data, encrypting stolen files with AES-GCM before exfiltrating them to a remote command-and-control server.<\/p>\n

[…]<\/p>\n

Unlike the payload it eventually installs, the dropper is properly code signed and notarized: it is a universal (arm64 and x86_64) binary signed with the Developer ID Emil Grigorov (WWB7JA7AQV)<\/code>, has hardened runtime enabled, and carries a stapled notarization ticket. Notably, the disk image itself is signed as well, not just the application inside it, which is uncommon in malicious DMG delivery where the container is typically left unsigned.<\/p>\n

[…]<\/p>\n

That file supplies the curl<\/code> command the dropper runs next. Staging the first hop on a trusted developer domain keeps the initial network activity inconspicuous.<\/p>\n

[…]<\/p>\n

[The script] clears extended attributes on the staged bundle with xattr -cr<\/code>, makes the inner binary executable, strips the payload's existing signature and re-signs it ad-hoc (codesign --remove-signature<\/code> followed by codesign -s - --force --deep --no-strict<\/code>), registers it with Launch Services via lsregister -f<\/code>, and finally launches it in the background with open -g -n<\/code>.<\/p>\n<\/blockquote>\n\n

Previously:<\/p>\n