Jamf Threat Labs researchers recently identified a fresh, multi-stage AmnesiaStealer macOS infostealer circulating online. Specifically, this malware exploits social engineering rather than software vulnerabilities to compromise Apple computers. Victims first land on a fake GitHub download page. Next, this page prompts them to run a malicious Terminal command. Consequently, that action triggers the infection. The new AmnesiaStealer macOS infostealer malware then steals sensitive data.

At a Glance Field Detail Malware family CrashStealer (native C++ macOS infostealer) Threat actor Unattributed; part of a larger multi-platform operation Targets macOS users, especially cryptocurrency holders Delivery vector Signed, notarized dropper disk image posing as an installer Key capabilities Browser, wallet, password-manager and keychain theft; AES-GCM encryption; LaunchAgent persistence Source Jamf Threat Labs (July 2026) TL;DR Jamf Threat Labs has detailed a new macOS…

CrashStealer is a newly identified macOS information stealer built in native C++ that uses a signed and notarized dropper to bypass Gatekeeper, then harvests browser credentials, crypto wallets, password managers, and keychain data. It validates the victim’s password locally, encrypts stolen data with AES-GCM, and exfiltrates it to an attacker-controlled server...

CHILLYHELL macOS malware, notarized since 2021, exposed May 2025 with flexible persistence and C2 evasion tactics.

Jamf Threat Labs informa sobre una variante del malware MacSync Stealer