Listen to the episode
TLDR
CrashStealer is a new macOS infostealer that impersonates Apple's CrashReporter component, uses a notarized installer to slip past Gatekeeper, and tricks users into typing their system password into a fake macOS prompt. Once entered, the...
How it works
CrashStealer is a new macOS infostealer that impersonates Apple's CrashReporter component, uses a notarized installer to slip past Gatekeeper, and tricks users into typing their system password into a fake macOS prompt. Once entered, the...
Red flags
- Unexpected request to download a standalone "CrashReporter" app from a third party site. An installer unlocked only by a private PIN shared in a meeting invite or chat. A system style password prompt appearing immediately after launching an unfamiliar app claiming to be a built in macOS component
What to do
- 1Never enter your macOS login password at prompts triggered by apps you did not deliberately install. Verify PIN gated download requests through a separate, trusted channel before installing anything. Keep macOS and reputable security software updated, and avoid storing high value crypto wallets and password
Source
malwarebytes
Source reviewed by Mythos Forensic Team
https://www.malwarebytes.com/blog/threat-intel/2026/07/this-fake-apple-app-can-unlock-your-macs-password-vaultFAQ
Is CrashStealer: Fake Apple CrashReporter app steals Mac Keychain passwords a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Unexpected request to download a standalone "CrashReporter" app from a third party site. An installer unlocked only by a private PIN shared in a meeting invite or chat. A system style password prompt appearing immediately after launching an unfamiliar app claiming to be a built in macOS component
What should I do first?
Never enter your macOS login password at prompts triggered by apps you did not deliberately install. Verify PIN gated download requests through a separate, trusted channel before installing anything. Keep macOS and reputable security software updated, and avoid storing high value crypto wallets and password
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.