TLDR Tech / InfoSec
New CrashStealer Malware Poses as Apple Crash Reporting Tool
Jamf uncovered a new macOS infostealer they dubbed CrashStealer because it impersonates the built-in CrashReporter tool. The malware displays a fake password prompt, verifies the entered password, then uses it to unlock the OS keychain and steal other credentials. CrashStealer focuses on stealth and uses a notarized dropper and AES-256-GCM to encrypt zip archives of stolen credentials before exfiltration.
Read the full story