CrashStealer: New macOS Infostealer Uses Signed Apps to Evade Gatekeeper
2026-07-14T08:51:46Z•9c21eb38f2471de564ecccebc0d4dd529bf87ff25abba2a813ee15197cd42db8
AES encryptionCISACMS exploitationCVE-2008-4128Cisco IOSCrashStealerEU sanctionsFSB-linked actorsGatekeeper bypassJoomlaKEVProgress ShareFileRyukWordPresscredential theftcrypto-walletsdata breachincident responseinfostealermacOSransomwaresigned appsthird-party breachwebshells
What happened
Multiple active threats and incidents reported: a new macOS infostealer named CrashStealer (signed app to bypass Gatekeeper) is in-the-wild and steals credentials and crypto wallets, encrypting exfiltrated data with AES; a third-party breach exposed Lidl online-shop customer personal data in Germany/Belgium/Netherlands; CISA added Cisco IOS flaw CVE-2008-4128 to its Known Exploited Vulnerabilities catalog; Australia warned of a large CMS exploitation campaign deploying webshells against WordPress, Joomla and other sites; Dutch suspects are linked to the Odido breach affecting ~6M customers; EU
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 9c21eb38f2471de564ecccebc0d4dd529bf87ff25abba2a813ee15197cd42db8
- Enrichment time
- 2026-07-14T08:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.