Beware of fake Mac crash reports out to steal your passwords

While macOS is generally very stable, there are times when an app will crash and your Mac will offer to send a diagnostic report to Apple.

A new form of Mac malware has been discovered, which creates fake versions of this form, requesting your Mac password as part of the data collection. If you comply, it will get access to a huge range of personal data, including your password managers and <a href="https://<a href="https://cryptoz7.com/crypto-market-july-2026-bitcoin-at-breaking-point/” title=”Crypto Market July 2026: Bitcoin at Breaking Point”>cryptoz7.com/clarity-act-explained-u-s-crypto-regulation/” title=”CLARITY Act Explained: U.S. Crypto Regulation”>cryptocurrency wallets …

Jamf says it first began tracking the malware in May, and has now seen it in the wild.

In early May, a suspicious macOS sample uploaded to VirusTotal surfaced through our sample-processing pipeline, and Jamf Threat Labs began tracking it. It impersonated Apple’s crash reporting framework and, at that point, looked like an infostealer still in development. By early July we were seeing in-the-wild detections of the payload matching one of our in-house rules, indicating the project had matured from development into active use. We track this malware under the name CrashStealer.

The cybersecurity company says that the disk image used to distribute the malware initially had a valid Apple Developer ID and notarization that allowed it to pass Gatekeeper checks.

Initial access is through a disk image named “Werkbit Setup,” which mounts at /Volumes/Werkbit Setup and contains a single application bundle, Werkbit.app. Its executable is named veltod and carries the bundle identifier dev.golove.velto. Unlike the payload it eventually installs, the dropper is properly code signed and notarized: it is a universal (arm64 and x86_64) binary signed with the Developer ID Emil Grigorov (WWB7JA7AQV), has hardened runtime enabled, and carries a stapled notarization ticket. Notably, the disk image itself is signed as well, not just the application inside it, which is uncommon in malicious DMG delivery where the container is typically left unsigned.

Macworld says that Apple has revoked the credentials, so it should now be detected by Gatekeeper. However, caution is still advised. In addition to looking out for that disk image, you should also closely examine app crash reports and any password prompt saying that System Preferences wants to make changes.

As always, your best protection is to ensure that you only ever download apps from the Mac App Store and the websites of developers you trust.

You’re reading 9to5Mac — experts who break news about Apple and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Mac on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel