CrashStealer: Native C++ macOS Infostealer Impersonating Apple's CrashReporter, Delivered via Notarized "Werkbit" Meeting-App Lure

CrashStealer (TL-2026-1270), also tracked as Werkbit Stealer, is a high-severity malware campaign, first published 2026-07-13. It has no confirmed attribution, affects Apple macOS, maps to 31 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-1270

Threat ID
TL-2026-1270
Also known as
Werkbit Stealer
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-13
Last reviewed
2026-07-13
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, finance, cryptocurrency, general enterprise
Target regions
Global
Detection rules
9
Indicators of compromise
24

Malware and tooling in CrashStealer

Malware and tooling: CrashStealer, Werkbit

CrashStealer is a native C++ macOS infostealer discovered by Jamf Threat Labs that disguises itself as Apple's CrashReporter.app (bundle ID com.apple.crashreporter) and is delivered as a second-stage payload from a signed, Apple-notarized, PIN-gated fake meeting/collaboration app called Werkbit (distributed via werkbit[.]io). It displays a spoofed macOS password-authorization dialog to harvest the user's login password, unlocks the keychain, and exfiltrates browser data, ~80 cryptocurrency wallet extensions, and 14 password managers. It is part of a larger cross-platform operation sharing backend infrastructure with several lookalike meeting-app lures.

How CrashStealer works

CrashStealer is a native C++ (not AppleScript/Objective-C) macOS infostealer first spotted by Jamf Threat Labs as a suspicious VirusTotal sample in May 2026, with confirmed in-the-wild detections on customer Macs beginning in early July 2026. The infection chain begins with Werkbit, a fake meeting/collaboration application distributed through the attacker-registered domain werkbit[.]io (registered late June 2026). Access to the Werkbit installer is gated behind a meeting PIN, indicating the operators send the link directly to hand-picked targets rather than exposing it to automated scanners or casual visitors — a targeted, low-and-slow distribution model rather than a smash-and-grab campaign. The Werkbit first-stage binary (internal executable name 'veltod') carries a valid Apple Developer ID (associated with the name Emil Grigorov, since revoked by Apple) and is Apple-notarized, and the disk image itself is additionally signed — an unusual extra layer of legitimacy rarely seen in malicious DMG campaigns — allowing it to pass Gatekeeper without an unidentified-developer warning.

Once launched, Werkbit executes a command chain that reaches out to a GitHub-hosted repository (mgothiclove/pkeys) to retrieve a further staging component, which in turn contacts the endpoint-api-v1[.]com infrastructure to fetch an obfuscated shell script. That script decodes and drops the actual CrashStealer payload, packaged as CrashReporter.dmg containing CrashReporter.app — using the bundle identifier com.apple.crashreporter, an Apple-styled icon, and permission descriptions that request Full Disk Access under the pretext of 'system administration,' designed to normalize the invasive grant to an unsuspecting victim. The payload stages itself first at /private/tmp/.CrashReporter/ before installing persistently at ~/Library/Caches/com.apple.crashreporter/.

After installation, CrashStealer displays a spoofed macOS-style authorization window that closely mimics the OS's native password prompt, asking the victim to enter their account password ostensibly for a system operation. The entered password is captured by the malware and locally validated using Apple's dscl command-line utility (rather than sent to a remote validation service, reducing network fingerprints), after which CrashStealer uses the confirmed-valid password to unlock the user's login keychain (login.keychain-db) and gain access to any credentials stored there.

With keychain access secured, CrashStealer performs a broad credential- and data-harvesting sweep: profiles, cookies, saved logins and installed extensions from all major Chromium-family browsers (Chrome, Brave, Edge, Opera, Vivaldi) and Firefox; roughly 80 distinct cryptocurrency wallet browser-extension types spanning Ethereum, Solana, Cosmos and TON ecosystems; and 14 password-manager applications including 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC and NordPass. It additionally performs targeted filesystem reconnaissance of the Documents and Downloads folders (explicitly excluding caches and media files to reduce archive size and dwell time), and profiles the host for installed endpoint-protection and analysis tooling.

Stolen data is staged into hidden ZIP archives encrypted client-side with AES-256-GCM via Apple's own CommonCrypto framework before exfiltration over libcurl — an encryption-first design intended to defeat network-layer inspection of the outbound payload. Earlier, less-hardened samples exposed a hardcoded C2 endpoint (179.43.166.242) via an App Transport Security exception entry, though later builds appear to route through the endpoint-api-v1[.]com infrastructure instead.

For persistence, CrashStealer installs a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist, re-signing a copied executable with an ad hoc signature so it can be relaunched at every login and automatically restored if killed or if the exit is abnormal. The malware employs multiple defense-evasion and anti-analysis techniques consistent with 'professionalizing' macOS malware tradecraft: control-flow flattening to defeat static disassembly, encrypted embedded strings, layered anti-debugging checks, extended-attribute (quarantine flag) stripping on dropped components, and active scanning for security tools and analysis environments before executing sensitive stages.

Jamf Threat Labs assesses CrashStealer is part of a larger, multi-platform operation rather than an isolated campaign: researchers identified several additional lookalike fake meeting/collaboration-app domains (resembling Cohezo, Cordinex, Synerix, Collabox, and Werknova) that share a common backend at icky-lyrical[.]com, along with a live operator 'Command Panel' login page and a Windows installer variant distributed alongside the macOS payload — indicating a cross-platform credential-theft-as-a-service style operation targeting both macOS and Windows users through the same social-engineering pretext of fake meeting invitations. Apple has since revoked the Developer ID signing credentials used to notarize Werkbit after Jamf disclosed its findings.

MITRE ATT&CK techniques used in TL-2026-1270

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel

Credential Access

T1056 Input Capture; T1187 Forced Authentication; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Initial Access

T1195 Supply Chain Compromise; T1566 Phishing

Persistence

T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

defense-impairment

T1553 Subvert Trust Controls; T1685 Disable or Modify Tools

Resource Development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities

Impact

T1657 Financial Theft

Affected products and versions in CrashStealer

  • Apple — macOS
    Vulnerable versions: all supported macOS versions with Gatekeeper/notarization enforcement
  • 1Password — 1Password browser extension / app
    Vulnerable versions: all versions (targeted via local keychain/vault access, not a product vulnerability)
  • Bitwarden — Bitwarden browser extension
    Vulnerable versions: all versions (targeted via local data theft, not a product vulnerability)
  • LastPass — LastPass browser extension
    Vulnerable versions: all versions (targeted via local data theft, not a product vulnerability)
  • Google — Chrome / Chromium-family browsers
    Vulnerable versions: all versions (local profile/cookie theft, not a product vulnerability)
  • Mozilla — Firefox
    Vulnerable versions: all versions (local profile theft, not a product vulnerability)

Remediation for CrashStealer

Immediate actions

  • Block network traffic to werkbit[.]io, endpoint-api-v1[.]com, icky-lyrical[.]com, and IP 179.43.166.242
  • Search endpoints for the LaunchAgent ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist and remove it
  • Search for and quarantine/remove ~/Library/Caches/com.apple.crashreporter/ and /private/tmp/.CrashReporter/
  • Revoke and rotate all credentials stored in browser password stores, password managers, and cryptocurrency wallet extensions on any host suspected of compromise
  • Audit Full Disk Access grants in System Settings > Privacy & Security for any app named CrashReporter.app or unrecognized entries
  • Force logout and re-authenticate keychain sessions on suspected hosts to invalidate any credential captured via the spoofed password prompt

Workarounds

  • Cancel any unexpected macOS password-authorization prompt triggered by a non-Apple application and manually verify the requesting process via Activity Monitor before entering credentials
  • Reject unsolicited CrashReporter, Werkbit, or similarly named meeting-app downloads regardless of valid code signature or notarization status

Longer-term hardening

  • Deploy EDR with behavioral detection for anomalous LaunchAgent creation, ad hoc re-signing of binaries, and dscl-based local password validation by third-party apps
  • Implement application allowlisting for macOS fleets to restrict execution of unsigned/newly-notarized applications from outside managed channels
  • Monitor Gatekeeper/notarization logs and Apple Developer ID revocation feeds for reused or related signing identities
  • User awareness training on verifying meeting/collaboration app invitations directly with senders before installing PIN-gated downloads
  • Extend detection coverage to cross-platform lookalike lures (Cohezo, Cordinex, Synerix, Collabox, Werknova) given shared backend infrastructure

Weaknesses (CWE) in CrashStealer

CWE-451, CWE-506, CWE-522

Timeline of CrashStealer

  • Jamf Threat Labs first observes a suspicious CrashStealer-related sample uploaded to VirusTotal, prior to any confirmed in-the-wild detections.
  • The werkbit[.]io distribution domain is registered by the operators in late June 2026 ahead of active campaign use.
  • Jamf identifies a cluster of related lookalike meeting/collaboration-app domains (Cohezo, Cordinex, Synerix, Collabox, Werknova) sharing a common backend at icky-lyrical[.]com, alongside a Windows installer variant, indicating a broader cross-platform operation.
  • Investigation traces the Werkbit first-stage dropper to a valid, Apple-notarized Developer ID associated with the name Emil Grigorov.
  • Jamf Threat Labs confirms in-the-wild detections of CrashStealer on customer Mac endpoints, beginning formal tracking of the campaign.
  • The Jamf findings are picked up and independently reported by Cyber Security News, AppleInsider, and MacTech, amplifying awareness of the campaign among Mac administrators and end users.
  • Apple revokes the Developer ID signing credentials associated with Emil Grigorov used to notarize the Werkbit application, after Jamf shares its findings with Apple's security team.
  • Jamf Threat Labs publishes its full technical analysis of CrashStealer on the Jamf blog, detailing the Werkbit infection chain, persistence mechanism, targeted credential stores, anti-analysis tradecraft, and IOCs.

Sources cited for CrashStealer

Threats related to CrashStealer

Detection coverage for TL-2026-1270

As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1270 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1270

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats