New macOS Malware Impersonates Apple’s Notarized Installer

A newly identified macOS information-stealing malware family, dubbed CrashStealer, is raising concerns after leveraging an Apple-notarized installer to bypass one of macOS’s most important security protections. By abusing Apple’s trusted software signing and notarization process, the malware is able to execute without triggering the Gatekeeper security warnings that users typically rely on to identify potentially malicious applications.

Researchers at Jamf Threat Labs, who first discovered the threat, say CrashStealer is designed to harvest a broad range of sensitive information from infected Macs, including browser credentials, macOS Keychain secrets, password manager databases, cryptocurrency wallet extensions, and user documents. Although analysts first observed samples of the malware in May 2026 while it appeared to still be under active development, the campaign became operational in early July, indicating that the malware has now matured into a fully functional information-stealing platform.