CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks
2026-07-14T01:24:13Z•fab0497ab389eb5b1c258795a9dbac2dd7cab589131ea2d722a83259cf9d2b98
Balbooa FormsCVE-2026-48939CrashStealerEvilginx phishing kits','WordPress backdoor','WP-SHELLSTORM','IoForg365 PhaaSGatekeeper bypassInjective LabsJoomla iCagendaMODBEACON RATMemGhost AI poisoningMicrosoft 365 phishingModHeaderProgress SoftwareRust malwareShareFile Storage Zone ControllerU-Boot vulnerabilitiesXQUIC / XRING DoSZimbra stored XSSbootloader RCEbrowser extension compromisecrypto wallet theftgRPC C2jscramblermacOS malwarenpm supply‑chain
What happened
A wave of high-impact supply-chain, zero-day, and targeted attacks was reported: a new macOS info‑stealer named CrashStealer uses a notarized C++ dropper to bypass Gatekeeper; popular browser extension ModHeader was pulled after a dormant history‑collector was found; multiple npm/ GitHub package compromises (jscrambler, Injective Labs SDK) dropped infostealers and wallet‑key stealers; CISA added two maximum‑severity Joomla extension flaws (including CVE-2026-48939) reportedly exploited as zero‑days; a critical stored‑XSS in Zimbra Classic Web Client could lead to arbitrary code execution; an “
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- fab0497ab389eb5b1c258795a9dbac2dd7cab589131ea2d722a83259cf9d2b98
- Enrichment time
- 2026-07-14T01:24:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.