CrashStealer
Named by 2 kept items in this workspace.
Search every workspace for CrashStealer. It matches the name as written, so it can find other things that share it.
The items that name it 2
Novel C/C++ macOS infostealer impersonating Apple's crash reporting framework to harvest credentials and keychain data; published by Ties at Jamf. OSM (Paul McCarty) found the same threat actor also running a RAT and additional malware tracks in parallel after the original report.
Malware discussed alongside Hugging Face incident and RubyGems
All threat actors in this workspace.