What happened
Researchers at Jamf Threat Labs have identified a new macOS information stealer dubbed CrashStealer, written in native C++ rather than the AppleScript or Objective-C wrappers common to similar tools. Its most notable feature is a notarized dropper, meaning it carries Apple's own cryptographic stamp of approval and sails through Gatekeeper without triggering standard warnings. The malware verifies the victim's login password locally before proceeding, reducing noisy network calls that could expose it to detection. Separately, CISA has published a postmortem on an incident first surfaced by KrebsOnSecurity, in which a contractor inadvertently pushed dozens of internal CISA credentials—including AWS GovCloud access keys—to a public GitHub repository, where they remained exposed for nearly six months before anyone at the agency was alerted.
Why it matters for your business
CrashStealer demonstrates that Apple's notarization process, while useful, is not a sufficient security boundary; threat actors are actively obtaining notarized certificates to weaponize a mechanism that most Mac users treat as a green light. Organizations that rely on macOS endpoints for finance, legal, or engineering work should layer endpoint detection beyond OS-native controls. The CISA leak is equally instructive: even a federal cybersecurity authority went nearly half a year without detecting live credentials in a public code repository. Every organization that touches cloud infrastructure should implement automated secret-scanning in CI/CD pipelines, enforce short-lived credentials, and conduct regular audits of contractor repository permissions—waiting for an outside reporter to flag the problem is not an acceptable posture.
What to watch next
Apple has not commented on how the notarized dropper cleared its review process, and it remains unclear whether the certificate has been revoked—watch for an Apple security update or developer guidance in the coming weeks. On the CISA side, the agency's postmortem is expected to prompt updated contractor security requirements, potentially influencing procurement standards across other federal departments. Broader legislative pressure around mandatory secret-scanning for government vendors may also accelerate following this disclosure.