Back Mactech

Jamf Threat Labs releases analysis of macOS info stealer dubbed 'CrashStealer'

Mactech • July 13, 2026

Jamf Threat Labs has released its analysis of a previously undocumented macOS infostealer, dubbed “CrashStealer.”

Written in native C++, the malware was detected in the wild in early July with the goal of harvesting data across browsers, cryptocurrency wallets, password managers, and more.

CrashStealer is delivered through a disk image that impersonates Apple’s built-in crash-reporting component, aiming to deceive victims through just a slight alteration in the impersonating application’s name.

I hope you’ll help support Apple World Today by becoming a patron. Almost all our income is from Patreon support and posts. Patreon pricing ranges from $2 to $10 a month. Thanks in advance for your support.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PamStealer: New macOS Infostealer Targets Users via Fake Maccy Manager PamStealer is a newly identified macOS infostealer that masquerades as the legitimate Maccy clipboard manager. The malware employs a two-stage attack method, starting with a malicious AppleScript that downloads a Rust-based payload. It verifies Mac login passwords using Apple's Pluggable Authentication Modules (PAM) before stealing sensitive data, enhancing the effectiveness of stolen credentials. The attack vector involves a fraudulent website mimicking the official Maccy page, leading to the download of a malicious disk image. Once executed, PamStealer collects browser cookies, saved credentials, clipboard contents, and more, while also establishing persistence on the infected system. The malware's design incorporates social engineering tactics to convince users to enter their passwords. Jamf Threat Labs has documented this campaign, emphasizing its unique features compared to typical macOS infostealers. 60 sources 68

Extracted Entities

Jamf Threat Labs releases analysis of macOS info stealer dubbed 'CrashStealer'

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)