A new information stealer targeting macOS systems has emerged with a notable distinction: it uses Apple's own notarization process to bypass Gatekeeper security checks. Researchers at Jamf Threat Labs have documented CrashSteaker, a C++-based malware that represents a shift in how attackers approach macOS compromise, moving away from AppleScript and Objective-C implementations toward native compiled code.
The Notarization Exploit
Apple's notarization system was introduced as a security layer to prevent unsigned or malicious code from running on macOS. When a developer submits software to Apple for notarization, the company performs automated analysis and cryptographically signs the application, allowing it to pass Gatekeeper checks without user warnings. CrashStealer's dropper abuses this legitimate process by obtaining valid notarization, making the malware appear trustworthy to both end users and system security tools.
This approach is particularly effective because users have been conditioned to trust notarized software. The presence of Apple's signature creates a false sense of legitimacy. System administrators accustomed to blocking unsigned code may inadvertently allow CrashStealer through their defences, assuming the notarization vouches for the application's safety.
Native C++ Implementation and Data Harvesting
Unlike previous macOS information stealers that relied on interpreted languages or scripting frameworks, CrashStealer is written in native C++. This choice offers several advantages to attackers. Compiled code is harder to reverse engineer than scripts, runs with native performance, and can interact directly with macOS system libraries to access sensitive information stored locally.
The malware performs local password validation before attempting credential theft, suggesting careful targeting or multi-stage infection logic. Once installed, it harvests credentials, browsing data, cryptocurrency wallets, and other sensitive information. For hosting providers and infrastructure operators, this type of activity poses a risk when users access management panels or sensitive services from compromised systems.
Infrastructure and Operations Security Implications
The rise of notarization-bypassing malware affects not just individual users but also organisations managing servers and infrastructure. If an administrator or engineer uses a compromised macOS system to access cloud control panels, deploy applications, or manage SSH keys, the consequences can be severe. Stolen credentials grant attackers direct access to hosting accounts, server infrastructure, and sensitive deployment pipelines.
This threat is particularly concerning for teams operating offshore infrastructure, where access controls and audit trails are often scrutinised more closely. A compromised administrator account could lead to unauthorised access, data exfiltration, or malicious modifications to hosted systems. Organisations should assume that any macOS system used for administrative work could be targeted and implement additional controls such as hardware security keys, certificate-based authentication, and IP-based access restrictions.
Detection and Mitigation
Endpoint detection and response (EDR) solutions designed for macOS must examine behaviour beyond code signatures. Since CrashStealer is notarized, traditional signature-based blocking will not stop it. Instead, organisations should monitor for suspicious activity such as unexpected credential access, password manager queries, or unusual network connections from notarized applications.
Administrators should maintain a strict inventory of which notarized applications are legitimate and necessary. Regular audits of installed software help identify unauthorised or suspicious applications. Additionally, enabling verbose logging and system monitoring on macOS systems used for infrastructure management provides visibility into potential compromise.
The CrashStealer case underscores a fundamental challenge in security: legitimate trust mechanisms can be subverted by determined attackers. Apple's notarization system remains valuable, but it is not a complete guarantee of safety. Organisations managing sensitive infrastructure must assume that endpoint compromise is possible and design their security posture accordingly, with layered defences, restricted credentials, and real-time monitoring of administrative activity.
