CrashStealer is Mac information-stealing malware, not an Apple crash-reporting update. If you opened Werkbit.app, a downloaded CrashReporter.app, or entered your Mac password into its prompt, disconnect the Mac from the network. Do not change passwords on that Mac. Use a separate trusted device for account recovery, and treat a correct password entry as possible exposure of browser sessions, Keychain data, password-manager files, and cryptocurrency wallets.
Merely seeing the lure or downloading a DMG is not the same as running it. The table below separates the response by what actually happened.
What Should You Do Right Now?
| What happened | Risk and next action |
|---|---|
| You only saw a Werkbit page or meeting lure | Close it. Do not download an app or enter a meeting PIN supplied by an unknown recruiter. No Mac cleanup is needed unless something else was opened. |
| You downloaded the DMG but never opened or mounted it | Move it to Trash and empty Trash. A downloaded-only file does not execute by itself. The downloaded-but-not-opened checklist explains the boundary. |
| You launched Werkbit or CrashReporter but did not enter a password | Disconnect the Mac. The first-stage app may already have fetched and launched the stealer, so canceling the password prompt is not proof that nothing ran. Check the exact persistence locations below. |
| You entered the Mac password | Treat the password as compromised and assume stored secrets may have been collected. Contain the Mac, recover accounts from a clean device, and strongly consider an erase and clean reinstall. |
What Is CrashStealer?
CrashStealer is a native C++ macOS infostealer analyzed by Jamf Threat Labs in 2026. The observed chain began with a signed and Apple-notarized disk image named Werkbit Setup. That first stage fetched a second disk image named CrashReporter.dmg, staged a fake CrashReporter.app under a hidden temporary path, removed quarantine metadata, re-signed the payload ad hoc, and launched it. [1]
Notarization helped the observed Werkbit dropper pass Gatekeeper at first launch; it did not certify the app’s future behavior as safe. This is an important distinction: a valid signature and notarization are useful checks, but they are not permission to trust an unexpected meeting app delivered by a stranger.
The downloaded CrashReporter name is also part of the deception. macOS has legitimate built-in crash-reporting components, but Apple does not require you to download a separate CrashReporter DMG from a recruiter, meeting site, or chat link. Do not delete ordinary Apple files or stop every process with “crash” in its name. The suspicious case combines the downloaded app with the exact user-library or temporary paths documented below.
What Does CrashStealer Steal?
Jamf observed the malware prompting for the Mac login password and validating it locally. A correct password let it unlock and copy the login Keychain. Its collection routines also targeted Chromium-family and Firefox browser data, cookies, saved credentials, cryptocurrency-wallet extensions, password-manager data, and selected files in user folders. The malware encrypted collected material and staged it in hidden directories before exfiltration. [1]
This means removal and account recovery are separate jobs. Deleting an app can stop future execution, but it cannot recall passwords, session cookies, wallet material, or documents that may already have left the Mac. The infostealer recovery overview explains why password changes alone may not invalidate stolen sessions.
Check the Exact CrashStealer Persistence
Keep the Mac offline while checking it. In Finder, choose Go → Go to Folder and inspect the exact paths below. Press Command-Shift-. in Finder if you need to reveal hidden items. Preserve screenshots or copies for an incident responder before removing anything on a managed or work Mac.
~/Library/LaunchAgents/com.apple.crashreporter.helper.plist— the observed user LaunchAgent that relaunches the malicious cached app at login.~/Library/Caches/com.apple.crashreporter/CrashReporter.app— the persisted, re-signed copy of the stealer.~/.cache/com.apple.crashreporter/— the hidden staging root used for collected material.~/.cache/com.apple.crashreporter/.zx_{8-hex}.zip— the observed pattern for encrypted archives left after the malware removed some temporary staging directories.~/.cache/.sys_auth— a local password cache artifact observed by the researchers./private/tmp/.CrashReporter/CrashReporter.app— the hidden temporary execution path created by the dropper chain.
The family name and exact paths matter. ClickLock Stealer and Odyssey Stealer can also pressure Mac users with fake prompts, but their delivery methods and persistence artifacts differ. Do not combine cleanup lists from unrelated families.
How to Remove CrashStealer From a Mac
- Disconnect Wi-Fi and Ethernet. Do not sign in to email, banking, exchanges, password managers, or work systems from the suspect Mac.
- Contact IT before changing a work Mac. The LaunchAgent, cached app, and staging archives can be valuable evidence. An administrator may need to isolate the device through its management or endpoint-security tools.
- Start in Safe Mode if the suspicious app keeps returning. Safe Mode can reduce automatically loaded software while you inspect the documented locations.
- Remove only confirmed CrashStealer artifacts. Move the exact malicious LaunchAgent, cached app, staging directory, and temporary app to Trash after recording them. Do not delete Apple files from
/Systemor unrelated LaunchAgents. - Review Login Items & Extensions. In System Settings, open General → Login Items & Extensions and remove unfamiliar items tied to the incident.
- Restart and re-check the same locations. If the LaunchAgent or app returns, another component or management profile may remain. Stop manual cleanup and escalate to an incident responder or erase/reinstall decision.
Manual removal cannot prove that stolen data was never transmitted, and it is not the strongest trust-restoration option after a verified password entry. If the Mac held a password vault, cryptocurrency wallet, administrator credentials, customer data, source code, or company access, preserve necessary personal documents and plan a clean erase and reinstall rather than restoring the entire old user Library.
Recover Passwords, Sessions, and Wallets From a Clean Device
Use a different trusted phone or computer. Start with accounts that can reset other accounts, then invalidate sessions that a password change may leave active.
- Secure your primary email. Change its password, sign out other sessions, review recovery addresses and forwarding rules, and enable multi-factor authentication.
- Change the Apple Account password. Review trusted devices, phone numbers, and account information, remove anything unfamiliar, and sign out browser sessions if needed. Apple recommends changing the password immediately when compromise is suspected. [2]
- Reset the password manager. Follow the vendor’s compromised-device procedure, rotate the master password, revoke sessions, and then rotate important stored credentials.
- Revoke browser and app sessions. Use “sign out everywhere” or device/session pages for email, social accounts, work tools, cloud storage, and financial services.
- Protect cryptocurrency separately. If wallet files, browser-wallet data, or a seed phrase may have been exposed, create a new wallet with a new seed on a trusted device and transfer remaining assets. Reusing the old seed does not remove the risk.
- Tell your employer or financial provider when relevant. Work credentials, payment accounts, identity documents, or unusual transfers require a faster coordinated response.
For a general order of operations across email, sessions, recovery methods, banking, and social accounts, use the account-hacked response checklist.
When Should You Erase and Reinstall macOS?
Erase and reinstall when you entered the Mac password, found the documented LaunchAgent or staging archives, used a cryptocurrency wallet or password manager on the Mac, handled sensitive work data, or cannot confidently explain every persistence change. It is also the safer route when suspicious components return after restart.
Back up irreplaceable personal documents first, but do not restore the suspicious app, old LaunchAgents, unknown browser extensions, shell configuration, or the whole ~/Library directory. Reinstall applications from official sources. Apple provides different erase paths for Apple silicon, T2-equipped Intel Macs, and older Intel hardware, so follow the instructions for the exact model. [3]
FAQ
Is every CrashReporter process on a Mac malware?
No. macOS includes legitimate crash-reporting components. The malicious case involves a downloaded app plus exact paths such as ~/Library/Caches/com.apple.crashreporter/CrashReporter.app and ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist.
Am I safe if I canceled the fake password prompt?
Canceling reduces credential exposure, but it does not prove the first-stage app failed to run. If you launched Werkbit or the downloaded CrashReporter app, disconnect the Mac and check the documented persistence locations.
Does deleting CrashReporter.dmg remove CrashStealer?
Only if the DMG was never opened or its app never ran. After execution, the dropper can stage and persist a separate app elsewhere, so deleting the download alone is not enough.
Can a notarized Mac app still be malicious?
Yes. Notarization checks a submitted app for known malicious content at that time; it is not a permanent guarantee of the app’s behavior or delivery context. The observed Werkbit first stage was signed and notarized yet fetched CrashStealer.
Should I change passwords on the infected Mac?
No. Use a separate trusted device. A still-compromised Mac could expose the new password or session again.
References
- Jamf Threat Labs. “CrashStealer: C++ macOS Infostealer Posing as Crash Reporter.” Jamf, July 13, 2026; accessed July 27, 2026. https://www.jamf.com/blog/crashstealer-macos-infostealer-analysis/
- Apple. “Keep Your Apple Account Secure.” Apple Personal Safety User Guide, October 2025; accessed July 27, 2026. https://support.apple.com/en-ca/guide/personal-safety/ips7d5628cc5/1.0/1.0
- Apple. “Erase and Reinstall macOS.” macOS User Guide; accessed July 27, 2026. https://support.apple.com/guide/mac-help/erase-and-reinstall-macos-mh27903/mac
