How macOS Malware Like CrashStealer Evades Apple's Defenses

According to a report by The Hacker News, security researchers have discovered a new macOS information stealer called CrashStealer. What makes this malware stand out is that it uses a signed and Apple-notarized dropper to bypass Gatekeeper, the built-in security check that blocks untrusted software.

This is significant because many Mac users assume that any app that passes Apple's notarization is safe. The attackers behind CrashStealer appear to have gone to great lengths to get their initial download signed and approved, then used it to quietly pull down the real malicious payload. The malware also requires a meeting PIN to access the download, suggesting the attackers are targeting specific victims rather than casting a wide net.

Why This Matters for Australian Businesses

For years, small and mid-sized businesses in Australia have been told that Macs are less prone to malware than Windows PCs. While that is still broadly true, malware like CrashStealer shows that determined attackers are now investing in macOS-specific tools. The malware steals browser credentials, cryptocurrency wallet extensions, password manager data, and even files from the Documents and Downloads folders.

The social engineering aspect is also a red flag. The installer instructs users to right-click the app and choose "Open" to bypass a standard security warning. Many busy employees might follow these steps without thinking, especially if they believe the app came from a trusted source. This kind of attack relies on human error, not just technical flaws.

What This Means for Australian SMBs

Australian small and mid-sized businesses that use Macs for day-to-day work—such as creative agencies, accounting firms, or retail management—need to take this threat seriously. If a single employee's Mac is compromised, the attacker could gain access to customer data, financial accounts, and internal systems. The malware also targets cryptocurrency wallets, which could be a direct hit for businesses that accept digital payments.

Because the malware uses a notarized dropper, traditional antivirus software may not catch it immediately. The payload only appears after the initial legitimate-looking app is run. This means a layered approach to security is essential, not just relying on Apple's built-in protections.

What You Can Do Now

  • Train your team to never right-click and "Open" an app that shows a security warning. Instead, they should only install software from the official App Store or trusted developer websites.
  • Enable multi-factor authentication (MFA) on all business accounts, especially email, banking, and password managers. Stolen credentials are useless without the second factor.
  • Keep macOS and all third-party apps updated. Apple regularly patches security flaws, and attackers often target outdated software.
  • Consider installing endpoint protection software that is designed for Macs and can detect unusual behavior, such as a legitimate-looking app that suddenly downloads more code.
  • Restrict software installation privileges to only authorized users. Use managed device policies to prevent employees from installing unsigned or unapproved applications.

Cybersecurity threats evolve quickly, and even trusted platforms like macOS can be exploited. At MS&VG, we help Australian small and mid-sized businesses assess their security posture and implement practical defences against modern threats like CrashStealer. Contact us to learn more about protecting your business.