CrashStealer: Native C++ macOS Information Stealer Validates Password Before Theft
Remove or quarantine CrashStealer from macOS systems and update security tools to detect native C++ stealers.
Remove CrashStealer from affected macOS machines and run a full malware scan.
Summary
Cybersecurity researchers have identified CrashStealer, a macOS information stealer written in native C++, that harvests sensitive data from compromised systems. Unlike other stealers that rely on AppleScript droppers or Objective‑C wrappers, CrashStealer validates the victim's login password locally before extracting credentials. The malware can steal passwords, cookies, and other sensitive data, and it is designed to evade detection by using native code. Jamf Threat Labs discovered CrashStealer and noted its ability to bypass standard security controls. The stealer can also exfiltrate data through covert channels, making it difficult to trace. No patch is currently available, and users must rely on endpoint protection to detect the threat. The discovery highlights the evolving sophistication of macOS malware. Security teams should monitor for native C++ binaries that attempt password validation on user systems.
Key changes
- CrashStealer is a macOS information stealer written in native C++
- It validates the victim's login password locally before stealing credentials
- The malware harvests passwords, cookies, and other sensitive data
- It uses native code to evade detection and bypass standard security controls
- Jamf Threat Labs discovered CrashStealer and noted its covert exfiltration
- No patch available; endpoint protection is required to detect it