CrashStealer stages encrypted zx_ zip archives in hidden cache dir

Duo Tech@duotech

•updated Jul 14, 2026•2•0•2

Detects the creation, modification, or renaming of ZIP archive files prefixed with 'zx_' within the macOS crash reporter cache directory. This behavior may indicate an adversary staging crash report data for potential exfiltration.