# CrashStealer: New macOS Info Stealer Bypasses Gatekeeper via Notarization

> CrashStealer macOS malware leverages C++ and notarized droppers to evade security checks and exfiltrate validated credentials from compromised Apple devices.

- Published: 2026-07-13T20:57:57.000Z
- Severity: high
- Category: Malware
- Tags: CrashStealer, macOS Security, Information Stealer, Gatekeeper Bypass, Jamf Threat Labs
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/07/crashstealer-macos-malware-uses.html
- Canonical: https://runtimerebel.com/blog/crashstealer-new-macos-info-stealer-bypasses-gatekeeper-via-notarization

## Key points

- Immediate impact: macOS users face high risk of credential theft and system compromise through a sophisticated C++ information stealer.
- Affected systems: macOS environments where notarized applications are trusted by default and lack additional endpoint monitoring layers.
- Remediation: Organizations must enhance endpoint visibility and pivot toward identity-centric security to mitigate the impact of notarized malware droppers.

## Overview of CrashStealer macOS Malware

A sophisticated new threat targeting the Apple ecosystem has emerged, identified as CrashStealer. This malware represents a shift in the development of macOS-centric threats, moving away from common scripting languages toward more robust implementations. According to research from [The Hacker News](https://thehackernews.com/2026/07/crashstealer-macos-malware-uses.html), this information stealer was discovered by Jamf Threat Labs, highlighting a significant evolution in how attackers approach the macOS platform.

CrashStealer is designed to harvest sensitive data, including login credentials and system information, from compromised machines. Unlike many contemporary stealers that rely on AppleScript or Objective-C wrappers, CrashStealer is built as a native C++ application. This choice of language provides the attackers with several advantages, including improved performance and the ability to utilize complex obfuscation techniques that can frustrate traditional [SIEM](/glossary#siem) analysis and signature-based detection.

## Technical Analysis: Notarized Dropper Tactics

The most concerning aspect of the CrashStealer infection chain is its use of a notarized dropper. Apple's notarization process is intended to scan software for malicious content before it is distributed. Once a binary is notarized, macOS Gatekeeper permits it to run with fewer warnings to the user. By successfully obtaining notarization for their initial stage dropper, the threat actors effectively bypass the primary layer of defense for macOS users.

This technique suggests a sophisticated understanding of Apple's security telemetry. Attackers often use [Phishing](/glossary#phishing) to deliver these notarized files, masquerading them as legitimate software updates or enterprise applications. Once executed, the dropper facilitates the deployment of the C++ payload. The use of notarization is increasingly seen as a targeted [Supply Chain Attack](/glossary#supply-chain-attack) on the trust model of the OS itself.

### How to Detect CrashStealer Infection Chain

Defenders should focus on identifying the specific [TTP](/glossary#ttp) used during the credential validation phase. One of the unique features of CrashStealer is its ability to validate the victim's login password locally on the device before attempting exfiltration. This local validation ensures that the data being sent to the [C2](/glossary#c2) server is accurate, reducing the 'noise' associated with failed credential harvesting attempts.

To effectively implement a strategy for mitigating macOS information stealer threats, security teams should look for unauthorized attempts to access the macOS Keychain or unusual API calls associated with password validation. Monitoring for the [IoC](/glossary#ioc) related to this malware requires a high degree of visibility into system calls, which is typically provided by a modern [EDR](/glossary#edr) solution. Relying solely on Gatekeeper is no longer sufficient when attackers can navigate the notarization workflow.

## Data Harvesting and Exfiltration Capabilities

Once the malware has established persistence and validated the user's password, it begins collecting a wide array of data. This includes browser history, cookies, and sensitive files stored in various application directories. The exfiltration process is managed through encrypted channels to hide the traffic from network-level security controls. This alignment with the [MITRE ATT&CK](/glossary#mitre-att-ck) framework demonstrates the malware's focus on long-term data collection rather than immediate disruption.

## Defensive Recommendations

To combat threats like CrashStealer, organizations must move beyond the perimeter and adopt a [Zero Trust](/glossary#zero-trust) architecture. This approach assumes that notarized applications can still be malicious and requires continuous verification of application behavior. For the [SOC](/glossary#soc), prioritizing the following actions is recommended:

*   **Enhance Endpoint Visibility:** Deploy advanced monitoring tools that can detect the execution of unsigned or recently notarized binaries that exhibit anomalous behavior.
*   **Credential Protection:** Implement multi-factor authentication (MFA) across all corporate resources to ensure that even if credentials are stolen via CrashStealer, they cannot be used for [Lateral Movement](/glossary#lateral-movement).
*   **User Training:** Educate employees on the dangers of downloading software from unofficial sources, even if the application appears to be 'verified' by macOS.

As threat actors continue to refine their macOS malware analysis evasion techniques, the reliance on automated notarization as a sole security signal must be re-evaluated by enterprise security teams.

**Related:** [OXLOADER Analysis: Malicious Google Ads Deliver CastleStealer Malware](/blog/oxloader-analysis-malicious-google-ads-deliver-castlestealer-malware), [Miasma Compromises 73 Microsoft GitHub Repos: Incident Analysis](/blog/miasma-compromises-73-microsoft-github-repos-incident-analysis)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/crashstealer-new-macos-info-stealer-bypasses-gatekeeper-via-notarization