macOS Stealer CrashStealer Poses as Crash Reporter to Target Crypto Wallets

Malware attacks targeting Apple users have recently become frequent on macOS. A new infostealer called PamStealer masquerades as the popular open-source clipboard utility Maccy and uses macOS’s built-in Pluggable Authentication Modules, or PAM, mechanism to verify administrator privileges. It can specifically steal browser credentials and cryptocurrency wallets. Its ability to bypass system safeguards poses a major threat to users’ digital assets.

Jamf Threat Labs disclosed the malware in July 2026. Attackers created the fake website maccyapp[.]com to trick users into downloading it. The software packages an AppleScript that, when users follow instructions to run it in Script Editor, downloads a second-stage payload written in Rust. The payload impersonates system applications such as Finder to evade detection and steal private data in the background.

macOS users are increasingly being targeted by information-stealing malware, with attackers often posing as Apple, Microsoft or Google update alerts to lower their guard. Reaper is particularly significant because it both creates a system backdoor and targets cryptocurrency wallets such as MetaMask and Phantom, potentially gaining access to credentials, private keys and control of assets.

A cybersecurity company recently disclosed that Reaper uses a mix of fake Apple, Microsoft and Google software updates to trick macOS users into installing it, after which it collects wallet data and steals assets. Existing reports have not disclosed the organization that discovered it, the exact disclosure date, the number of victims or the value of losses. Users should update software only through official channels.

CleanMyMac is a macOS cleanup tool developed by MacPaw. Attackers created an imitation website and used ClickFix social engineering to trick users into pasting commands into Terminal, bypassing Gatekeeper, Apple notarization and XProtect. The threat is particularly serious because leaked recovery phrases could allow attackers to take direct control of wallet assets.

Malwarebytes disclosed on March 6, 2026, that the fake website, cleanmymacos.org, downloads SHub Stealer. The malware steals Apple Keychain contents, browser data and Telegram sessions, and scans for 23 wallet applications. It also tampers with applications including Ledger Live to capture recovery phrases. The report did not disclose the number of victims or the amount of losses.