CrashStealer: Native C++ macOS Infostealer Impersonating Apple's CrashReporter, Delivered via Notarized "Werkbit" Meeting-App Lure — Threadlinqs Intelligence
As of 2026-07-13, CrashStealer: Native C++ macOS Infostealer Impersonating Apple's CrashReporter, Delivered via Notarized "Werkbit" Meeting-App Lure is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-1270 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
CrashStealer is a native C++ macOS infostealer discovered by Jamf Threat Labs that disguises itself as Apple's CrashReporter.app (bundle ID com.apple.crashreporter) and is delivered as a second-stage
CrashStealer is a native C++ (not AppleScript/Objective-C) macOS infostealer first spotted by Jamf Threat Labs as a suspicious VirusTotal sample in May 2026, with confirmed in-the-wild detections on customer Macs beginning in early July 2026. The infection chain begins with Werkbit, a fake meeting/collaboration application distributed through the attacker-registered domain werkbit[.]io (registered late June 2026). Access to the Werkbit installer is gated behind a meeting PIN, indicating the operators send the link directly to hand-picked targets rather than exposing it to automated scanners or casual visitors — a targeted, low-and-slow distribution model rather than a smash-and-grab campaign. The Werkbit first-stage binary (internal executable name 'veltod') carries a valid Apple Developer ID (associated with the name Emil Grigorov, since revoked by Apple) and is Apple-notarized, and the disk image itself is additionally signed — an unusual extra layer of legitimacy rarely seen in malicious DMG campaigns — allowing it to pass Gatekeeper without an unidentified-developer warning.
Once launched, Werkbit executes a command chain that reaches out to a GitHub-hosted repository (mgothiclove/pkeys) to retrieve a further staging component, which in turn contacts the endpoint-api-v1[.]com infrastructure to fetch an obfuscated shell script. That script decodes and drops the actual CrashStealer payload, packaged as CrashReporter.dmg containing CrashReporter.app — using the bundle identifier com.apple.crashreporter, an Apple-styled icon, and permission descriptions that request Full Disk Access under the pretext of 'system administration,' designed to normalize the invasive grant to an unsuspecting victim. The payload stages itself first at /private/tmp/.CrashReporter/ before installing persistently at ~/Library/Caches/com.apple.crashreporter/.
After installation, CrashStealer displays a spoofed macOS-style authorization window that closely mimics the OS's native password prompt, asking the victim to enter their account password ostensibly for a system operation. The entered password is captured by the malware and locally validated using Apple's dscl command-line utility (rather than sent to a remote validation service, reducing network fingerprints), after which CrashStealer uses the confirmed-valid password to unlock the user's login keychain (login.keychain-db) and gain access to any credentials stored there.
With keychain access secured, CrashStealer performs a broad credential- and data-harvesting sweep: profiles, cookies, saved logins and installed extensions from all major Chromium-family browsers (Chrome, Brave, Edge, Opera, Vivaldi) and Firefox; roughly 80 distinct cryptocurrency wallet browser-extension types spanning Ethereum, Solana, Cosmos and TON ecosystems; and 14 password-manager applications including 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC and NordPass. It additionally performs targeted filesystem reconnaissance of the Documents and Downloads folders (explicitly excluding caches and media files to reduce archive size and dwell time), and profiles the host for installed endpoint-protection and analysis tooling.
Stolen data is staged into hidden ZIP archives encrypted client-side with AES-256-GCM via Apple's own CommonCrypto framework before exfiltration over libcurl — an encryption-first design intended to defeat network-layer inspection of the outbound payload. Earlier, less-hardened samples exposed a hardcoded C2 endpoint (179.43.166.242) via an App Transport Security exception entry, though later builds appear to route through the endpoint-api-v1[.]com infrastructure instead.
For persistence, CrashStealer installs a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist, re-signing a copied executable with an ad hoc signature so it can be relaunched at every login and automatically restored if killed or if the exit is abnormal. The malware employs multiple defense-evasion an
Weaknesses (CWE)
CWE-451, CWE-506, CWE-522
Target sectors: technology, finance, cryptocurrency, general enterprise
Target regions: Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1588, T1566, T1195, T1204, T1059, T1543, T1547, T1548, T1036
