New Malware Threat for Mac Users: CrashStealer
Disguised as Apple's crash report, this new malware steals user data.
1What is CrashStealer?
CrashStealer is a new information-stealing malware targeting macOS users. Posing as Apple's official crash reporting tool, it aims to steal user credentials. Identified by security firm Jamf, this malware spreads as 'CrashReporter.app' and appears to be notarized by Apple, making it look legitimate to unsuspecting users.
2How Does It Spread?
The malware is distributed through a fake software site promoting the 'Werkbit' meeting platform. Requiring a PIN for installation, this fake application uses social engineering techniques to trick users into installing it on their devices. The installation process mimics legitimate apps, making deception easier.
3What Data Does It Steal?
After obtaining the system password, CrashStealer accesses the user's Keychain to steal sensitive data like wifi and app passwords, certificates, and tokens. It also harvests credentials from Firefox and Chromium-based browsers, data from 14 different password managers, and access to 80 cryptocurrency wallet extensions.
4How Is It Detected?
The malware is designed to evade macOS's built-in malware prevention tool. It mimics a macOS authorization window requesting permission to change system preferences. If the user enters an incorrect password, the prompt repeats until the correct credentials are provided, maintaining the illusion of legitimacy.
5How Is Data Transferred?
Stolen data is encrypted and placed in a hidden ZIP archive before being uploaded to attackers' servers. This process happens silently in the background without user awareness. The malware also scans Documents and Downloads folders, potentially leading to additional data breaches.
6How to Protect Yourself?
Users should avoid installing apps from untrusted sources and be skeptical of system processes requesting passwords. Apple's crash reports never require passwords. If you suspect malware on your device, use trusted removal tools. Keeping up with regular security updates is also crucial for protection against such threats.
Original article: Lifehacker — Mac Kullanıcıları İçin Yeni Bir Malware Tehdidi: CrashStealer