[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fS8b622OxwZDoS7IbPJ_8KNam7MZ6wlIueMIit5xJq5Q":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"bcb06f00-51fb-4634-84d0-d1b7732ea4f0","notarized-macos-malware-bypasses-gatekeeper-to-steal-credentials","3c5a6963-2d17-41be-b4f2-0abbe3b041ea","Notarized macOS Malware Bypasses Gatekeeper to Steal Credentials","CrashStealer exploits the trust Apple's notarization process is meant to provide by using a legitimately signed and notarized dropper to slip past Gatekeeper — macOS's first line of defense against malicious software. This represents a supply-chain trust abuse scenario where the integrity verification mechanism itself becomes a vector for deception. Once installed, the malware aggressively harvests sensitive data from browsers, crypto wallets, password managers, and the system keychain, then exfiltrates it encrypted. This matters because users and security tools that rely solely on Apple's notarization as a trust signal are left with a critical blind spot, and the breadth of credential harvesting can lead to cascading account compromises across personal and financial systems.","**Immediate actions:**\n- Deploy an endpoint detection and response (EDR) solution on all macOS devices that performs behavioral analysis beyond notarization checks.\n- Audit and restrict access to sensitive macOS Keychain entries using application-specific access controls.\n- Block or alert on unexpected outbound encrypted connections from endpoints that don't match known application baselines.\n\n**Long-term improvements:**\n- Implement a Zero Trust posture that treats notarization as a necessary but insufficient trust signal, layering additional runtime behavior monitoring.\n- Enforce least-privilege principles by limiting which applications can access credential stores, password managers, and cryptocurrency wallet files.\n- Establish an application allowlisting policy so only explicitly approved binaries can execute, regardless of their signing status.\n\n**Detection measures:**\n- Monitor for unusual file access patterns targeting browser credential databases, keychain files, and wallet directories using file integrity monitoring tools.\n- Set up network-level DLP controls to detect and block bulk encrypted data exfiltration to unknown external endpoints.\n- Subscribe to macOS-specific threat intelligence feeds to receive timely indicators of compromise (IOCs) for emerging stealers.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 13: Data Protection","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SC-28: Protection of Information at Rest","NIST Cybersecurity Framework DE.CM-4: Malicious Code Detection","NIST SP 800-161: Supply Chain Risk Management","GDPR Article 32: Security of Processing","MITRE ATT&CK T1555: Credentials from Password Stores","MITRE ATT&CK T1553.001: Subvert Trust Controls – Code Signing",{},"published","2026-07-13T18:20:22.595668+00:00","2026-07-13T18:20:22.275+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fcrashstealer-macos-malware-uses.html","crashstealer-macos-malware-uses-notarized-dropper-to-pass-gatekeeper-checks-eca7de","CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[52,56,60],{"slug":53,"name":54,"problem":55},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":57,"name":58,"problem":59},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":61,"name":62,"problem":63},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]