CrashStealer macOS malware uses notarized dropper to pass Gatekeeper, researchers report

A new macOS information stealer dubbed CrashStealer is using a notarized dropper to pass Apple’s Gatekeeper checks, The Hacker News reports today. The tactic risks eroding user trust in Apple’s malware defenses by letting malicious code appear developer-vetted at install time. Researchers say the strain targets sensitive data on compromised Macs, raising fresh concerns for both consumers and enterprises.

Jamf Threat Labs says the native C++ payload arrives via a notarized package, contrasts with common AppleScript or Objective C wrappers, and locally validates a victim’s login password before harvesting sensitive data from compromised systems. The dropper bears Apple notarization, allowing it to pass Gatekeeper checks without blocking, The Hacker News notes. Watch for whether Apple revokes any abused certificates, for IOCs from Jamf, and for detection updates from vendors as the investigation unfolds. [Developing. This article will be updated.]