Fake Apple App Scam Targets Users

A newly discovered macOS malware, CrashStealer, is impersonating Apple's legitimate CrashReporter application to steal user credentials. 
 
Security researchers have been tracking the campaign since May 2026 after identifying a fake app that closely mimics Apple's icon, name, and system metadata.
 
The malware is distributed through an Apple-notarized installer named "Werkbit Setup." 
 
Although Apple's notarization process checks software for known threats, it is not a guarantee of safety. 
 
Attackers exploited this trust to bypass users' initial security concerns.
 
Hosted on a fake software website, the installer requires a meeting PIN, indicating the campaign is highly targeted rather than aimed at mass distribution. 
 
Once installed, it displays a convincing macOS password prompt.

 
If victims enter their administrator password, CrashStealer gains access to the macOS Keychain and steals browser credentials, cookies, cryptocurrency wallet data, password manager information, and selected files.
 
The incident highlights that security cannot rely solely on passwords or trusted installers. 
 
Organizations should adopt layered defenses, continuous monitoring, and behaviour-based authentication to better protect against sophisticated cyber threats.