New macOS Malware Mimics Apple Installer to Steal Data

Cybercriminals are actively distributing sophisticated new malware that impersonates Apple’s legitimate notarized installer. Identified as CrashStealer, the software utilizes a malicious dropper designed to bypass Apple’s built-in Gatekeeper security protections. This allows the threat to execute unauthorized code on infected systems while remaining undetected by standard macOS safety protocols.

Researchers have observed the campaign targeting users across more than 100 countries. The malware specifically attempts to harvest credentials and infiltrate sensitive data by masquerading as a system crash reporting tool. Odyssey Stealer is also identified as a key component of this wave, specifically targeting over 300 different cryptocurrency wallet extensions, underscoring the financial motivation behind the current distribution.

The emergence of this threat highlights ongoing challenges in maintaining macOS security as attackers evolve to bypass notarization verification. Users are urged to exercise extreme caution when downloading and running installers, even those appearing to be from reputable sources. Security professionals recommend rigorous verification of application signatures and monitoring for unusual system behavior to mitigate potential data exfiltration and credential theft risks.