# CrashStealer: Native C++ macOS Infostealer Impersonating Apple's CrashReporter, Delivered via Notarized "Werkbit" Meeting-App Lure

> CrashStealer is a native C++ macOS infostealer discovered by Jamf Threat Labs that disguises itself as Apple's CrashReporter.app (bundle ID com.apple.crashreporter) and is delivered as a second-stage payload from a signed, Apple-notarized, PIN-gated fake meeting/collaboration app called Werkbit (distributed via werkbit[.]io). It displays a spoofed macOS password-authorization dialog to harvest the user's login password, unlocks the keychain, and exfiltrates browser data, ~80 cryptocurrency wallet extensions, and 14 password managers. It is part of a larger cross-platform operation sharing backend infrastructure with several lookalike meeting-app lures.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1270
- **ID:** TL-2026-1270
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CrashStealer is a native C++ (not AppleScript/Objective-C) macOS infostealer first spotted by Jamf Threat Labs as a suspicious VirusTotal sample in May 2026, with confirmed in-the-wild detections on customer Macs beginning in early July 2026. The infection chain begins with Werkbit, a fake meeting/collaboration application distributed through the attacker-registered domain werkbit[.]io (registered late June 2026). Access to the Werkbit installer is gated behind a meeting PIN, indicating the operators send the link directly to hand-picked targets rather than exposing it to automated scanners or casual visitors — a targeted, low-and-slow distribution model rather than a smash-and-grab campaign. The Werkbit first-stage binary (internal executable name 'veltod') carries a valid Apple Developer ID (associated with the name Emil Grigorov, since revoked by Apple) and is Apple-notarized, and the disk image itself is additionally signed — an unusual extra layer of legitimacy rarely seen in malicious DMG campaigns — allowing it to pass Gatekeeper without an unidentified-developer warning.

Once launched, Werkbit executes a command chain that reaches out to a GitHub-hosted repository (mgothiclove/pkeys) to retrieve a further staging component, which in turn contacts the endpoint-api-v1[.]com infrastructure to fetch an obfuscated shell script. That script decodes and drops the actual CrashStealer payload, packaged as CrashReporter.dmg containing CrashReporter.app — using the bundle identifier com.apple.crashreporter, an Apple-styled icon, and permission descriptions that request Full Disk Access under the pretext of 'system administration,' designed to normalize the invasive grant to an unsuspecting victim. The payload stages itself first at /private/tmp/.CrashReporter/ before installing persistently at ~/Library/Caches/com.apple.crashreporter/.

After installation, CrashStealer displays a spoofed macOS-style authorization window that closely mimics the OS's native password prompt, asking the victim to enter their account password ostensibly for a system operation. The entered password is captured by the malware and locally validated using Apple's dscl command-line utility (rather than sent to a remote validation service, reducing network fingerprints), after which CrashStealer uses the confirmed-valid password to unlock the user's login keychain (login.keychain-db) and gain access to any credentials stored there.

With keychain access secured, CrashStealer performs a broad credential- and data-harvesting sweep: profiles, cookies, saved logins and installed extensions from all major Chromium-family browsers (Chrome, Brave, Edge, Opera, Vivaldi) and Firefox; roughly 80 distinct cryptocurrency wallet browser-extension types spanning Ethereum, Solana, Cosmos and TON ecosystems; and 14 password-manager applications including 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC and NordPass. It additionally performs targeted filesystem reconnaissance of the Documents and Downloads folders (explicitly excluding caches and media files to reduce archive size and dwell time), and profiles the host for installed endpoint-protection and analysis tooling.

Stolen data is staged into hidden ZIP archives encrypted client-side with AES-256-GCM via Apple's own CommonCrypto framework before exfiltration over libcurl — an encryption-first design intended to defeat network-layer inspection of the outbound payload. Earlier, less-hardened samples exposed a hardcoded C2 endpoint (179.43.166.242) via an App Transport Security exception entry, though later builds appear to route through the endpoint-api-v1[.]com infrastructure instead.

For persistence, CrashStealer installs a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist, re-signing a copied executable with an ad hoc signature so it can be relaunched at every login and automatically restored if killed or if the exit is abnormal. The malware employs multiple defense-evasion and anti-analysis techniques consistent with 'professionalizing' macOS malware tradecraft: control-flow flattening to defeat static disassembly, encrypted embedded strings, layered anti-debugging checks, extended-attribute (quarantine flag) stripping on dropped components, and active scanning for security tools and analysis environments before executing sensitive stages.

Jamf Threat Labs assesses CrashStealer is part of a larger, multi-platform operation rather than an isolated campaign: researchers identified several additional lookalike fake meeting/collaboration-app domains (resembling Cohezo, Cordinex, Synerix, Collabox, and Werknova) that share a common backend at icky-lyrical[.]com, along with a live operator 'Command Panel' login page and a Windows installer variant distributed alongside the macOS payload — indicating a cross-platform credential-theft-as-a-service style operation targeting both macOS and Windows users through the same social-engineering pretext of fake meeting invitations. Apple has since revoked the Developer ID signing credentials used to notarize Werkbit after Jamf disclosed its findings.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1566 Phishing
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1685 Disable or Modify Tools
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1056 Input Capture
- T1187 Forced Authentication
- T1518 Software Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [macOS Stealer Mimics Apple's Crash Report](https://cybersecuritynews.com/macos-stealer-mimics-apples-crash-report/)
- ['CrashStealer' malware poses as an Apple tool to steal passwords & Mac data](https://appleinsider.com/articles/26/07/13/crashstealer-malware-poses-as-an-apple-tool-to-steal-passwords-mac-data)
- [Jamf Threat Labs releases analysis of macOS info stealer dubbed 'CrashStealer'](https://www.mactech.com/2026/07/13/jamf-threat-labs-releases-analysis-of-macos-info-stealer-dubbed-crashstealer/)
- [Jamf Threat Labs dissects infostealer malware](https://www.jamf.com/blog/infostealers-pose-threat-to-macos/)
- [Jamf Threat Labs](https://www.jamf.com/threat-labs/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1270