CrashStealer and PamStealer: The New macOS Infostealers That Bypass Apple's Defenses

Two newly documented macOS infostealers — CrashStealer and PamStealer — represent an evolution in Mac malware tradecraft. First identified by Jamf Threat Labs in July 2026, both stealers bypass Apple's Gatekeeper security using different techniques, target a broad range of credentials including cryptocurrency wallets and password managers, and feature an unusual capability: they validate the victim's password on-device before exfiltrating it, ensuring the attacker receives a working credential ^CATJ.

CrashStealer: A C++ macOS Infostealer Impersonating Apple's Crash Reporter

What it is. CrashStealer is a C++ macOS infostealer first detected by Jamf Threat Labs in early July 2026 and publicly documented on July 13–14, 2026 ^TAJ. It impersonates Apple's legitimate crash-reporting framework by naming its binary CrashReporter.app, using the legitimate tool's icon and metadata to avoid raising suspicion ^AB.

Gatekeeper bypass via notarized dropper. The infection chain starts with a first-stage application called Werkbit — a signed, Apple-notarized app carrying a valid Developer ID associated with "Emil Grigorov" ^TAJ. Because Apple's notary service approved it, Gatekeeper treats it as trusted and does not show the usual "unidentified developer" warning ^AJ. Once the user manually downloads and opens Werkbit, a script downloads the real CrashStealer payload in the background ^TJ.

Credentials and data targeted. CrashStealer harvests broadly across the system:

• Browser credentials from Chrome, Firefox, Edge, Brave, Opera, and Vivaldi ^TJ.
• Approximately 14 password managers, including 1Password ^TA.
• Roughly 80 cryptocurrency wallet browser extensions and local wallet files ^TA.
• macOS Keychain data and system passwords ^TJ.

Key techniques.

• Local password validation before exfiltration. CrashStealer prompts the user for their Mac login password through a fake system dialog styled like Apple's legitimate prompt, then validates it locally before proceeding to steal data — ensuring the attacker gets a working credential ^TJ.
• AES-GCM encryption of stolen files before sending them to a remote command-and-control (C2) server, making network-level detection harder ^TJ.
• Persistence and disguise. After infection, it presents a convincing fake crash reporter screen to maintain the masquerade, copies itself to ~/Library/Caches/com.apple.crashreporter/, and creates a LaunchAgent named com.apple.crashreporter.helper to survive reboots ^FB.
• The malware also requests "Full Disk Access" permissions to broaden what it can steal ^F.

Apple's response. Apple revoked Werkbit's signing certificate after Jamf reported the malware ^TA.

PamStealer: A Rust-Based Stealer That Validates Passwords Through Apple's Own PAM API

What it is. PamStealer is a Rust-based, two-stage macOS infostealer disclosed by Jamf on July 2, 2026 ^AAS. Its name comes from its novel use of Apple's Pluggable Authentication Modules (PAM) API to verify stolen passwords ^AMDA.

Distribution and Gatekeeper evasion. PamStealer is served from typosquatted domains impersonating the legitimate Maccy clipboard manager (e.g., maccyapp[.]com) ^MIA. The attack bypasses Gatekeeper through a known but unpatched gap in macOS Script Editor:

• The victim downloads a trojanized disk image containing a compiled .scpt AppleScript file ^AAS.
• The lure instructs the user to open the file in Script Editor and press Command-R to run it ^AAS.
• Because Script Editor is a trusted system application, Gatekeeper's com.apple.quarantine protections are bypassed, and no warning is shown ^MDA.

Credentials and data targeted. The second-stage Rust payload steals:

• macOS login passwords (via PAM) and the local admin password ^MA.
• Browser-saved credentials, cookies, and clipboard contents ^AS.
• macOS Keychain contents ^AS.
• Ethereum wallet files and SSH keys ^SY.

Key technique — PAM-based password validation. This is PamStealer's signature innovation:

• When macOS presents a standard auth prompt ("Maccy wants to make changes"), the user types their password ^DA.
• Instead of blindly capturing it, PamStealer calls Apple's own PAM API (pam_start, pam_authenticate) to test the password against the system's authentication stack before recording it ^AMDA.
• If the password is correct, it exfiltrates it and proceeds to harvest other credentials. If not, it can prompt again or abort, reducing the risk of wasting resources on a bad credential ^DAS.
• This technique leaves fewer forensic traces than typical keyloggers or memory scrapers because it uses Apple's own API for verification rather than hooking system calls or reading memory buffers ^DA.

Broader Implications for Mac Malware Threats

• Notarization as a weapon. CrashStealer demonstrates that threat actors can successfully submit malicious apps to Apple's notary service and obtain Gatekeeper-passing signatures ^TJ. Apple's revocation process is reactive, not preventive — the malware can spread for days or weeks before the certificate is revoked. This follows a pattern seen with earlier malware like MacSync and the Odyssey Stealer family, which also abused valid Apple developer signatures ^MFS.

• Script Editor as a blind spot. Both PamStealer and a growing number of recent macOS threats exploit the fact that running AppleScripts through trusted system applications bypasses Gatekeeper entirely. Jamf notes this is a documented but still-unpatched gap ^DA.

• Mac infostealers are getting sophisticated. The use of AES-GCM encryption for exfiltrated data (CrashStealer) and PAM API validation (PamStealer) shows attackers investing in custom, stealthy tradecraft rather than relying on commodity malware ^DTJ. Microsoft also noted in February 2026 a broader trend of macOS, Python, and cross-platform infostealers using "ClickFix" social-engineering lures to steal browser passwords, crypto wallets, and cloud credentials ^M.

• Password validation on-device is a new reliability boost. Rather than guessing or bulk-collecting credentials, both of these stealers confirm the password is valid on the victim's machine before exfiltration — improving the attacker's success rate and reducing the chance of detection from failed logins ^TJ. This is a meaningful evolution: typical infostealers either capture whatever is typed or use techniques like dscl or security command calls that may fail silently or trigger alerts ^DS.