CrashStealer Mac malware steals passwords and wallets

Jamf Threat Labs discovered CrashStealer, a macOS malware that bypasses Gatekeeper via a signed Werkbit installer. The malware utilizes fake password prompts to steal browser credentials, Keychain data, and cryptocurrency wallets. It specifically targets 14 password managers and 80 crypto wallet extensions. By employing these deceptive tactics, CrashStealer effectively extracts sensitive information from Mac users, focusing on high-value digital assets and stored passwords to compromise the security of the affected systems.