CrashStealer: Signed & Notarized macOS Infostealer Delivered via Fake Meeting App "Werkbit" — Threadlinqs Intelligence
As of 2026-07-13, CrashStealer: Signed & Notarized macOS Infostealer Delivered via Fake Meeting App "Werkbit" is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 32 indicators of compromise.
Threat ID: TL-2026-1273 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
CrashStealer is a native C++ macOS infostealer distributed as a signed, Apple-notarized disk image ("Werkbit Setup") from the PIN-gated domain werkbit[.]io. After a multi-stage GitHub-relayed download
CrashStealer, documented by Jamf Threat Labs (researcher Thijs Xhaflaire) and reported by The Hacker News on 2026-07-13, is a native C++ macOS information stealer notable for reaching victims through a signed and Apple-notarized dropper — a technique that bypasses Gatekeeper's default unsigned/unnotarized-code blocking entirely. The initial lure, "Werkbit," is presented as a meeting/collaboration application distributed from werkbit[.]io, a domain registered in late June 2026, close to the malware's build date. Access to the installer disk image is gated behind a meeting PIN, meaning the file is served only to targets who receive the code directly rather than to any site visitor or automated scanner — a deliberate anti-analysis and targeting control.
The dropper, signed under Developer ID "Emil Grigorov" (Team ID WWB7JA7AQV, bundle identifier dev.golove.velto) as a universal (arm64/x86_64) binary with hardened runtime and a stapled notarization ticket, launches an executable named "veltod." This binary retrieves a hidden instruction file (sys.cache) from the GitHub repository mgothiclove/pkeys, which directs it to fetch an obfuscated shell script from endpoint-api-v1[.]com. That script downloads CrashReporter.dmg to /private/tmp/.CrashReporter/, strips the original code signature (codesign --remove-signature) and re-applies an ad-hoc signature (codesign -s - --force --deep --no-strict), removes the quarantine attribute (xattr -cr), and mounts the disk image with hdiutil using -nobrowse -noverify -noautoopen -quiet before launching the payload — CrashReporter.app, which impersonates Apple's built-in crash-reporting component via bundle identifier com.apple.crashreporter, an Apple-style icon, and matching display name.
Once running, CrashStealer presents a fake system password prompt and validates the entered credential locally using the legitimate dscl -authonly command, re-prompting on failure, before proceeding to harvest data. It targets Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, NAVER Whale, and Firefox (profiles, cookies, saved logins, extension storage); approximately 80 cryptocurrency wallet browser extensions spanning MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, Backpack, and Solana/Cosmos/TON/Sui/Aptos/NEO-ecosystem wallets; 14 password managers including 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm; the macOS login keychain (login.keychain-db); and files under ~/Documents, ~/Downloads, and ~/Desktop. It also performs security/analysis-tool discovery to detect monitoring software.
Collected data is staged under ~/.cache/com.apple.crashreporter/, with password material additionally cached in an obfuscated (not encrypted) file at ~/.cache/.sys_auth. Each collected file is individually encrypted with AES-256-GCM via Apple's CommonCrypto framework, using a PBKDF2-HMAC-SHA256 key derivation (10,000 iterations) and a hardcoded salt constant "panel_salt_v1" that appears to be an unremoved development default. Encrypted files (~8.0 bits/byte entropy, no readable headers) are packed into hidden ZIP archives named with the pattern .zx_[8-hex-chars].zip and exfiltrated via libcurl multipart form uploads (curl_mime) to the hardcoded C2 IP address 179.43.166.242, which was exposed in earlier development samples via an App Transport Security exception entry in Info.plist. Staging directories are deleted post-exfiltration, though the .zx_*.zip archives may persist on disk.
For persistence, CrashStealer installs a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist with label com.apple.crashreporter.helper, RunAtLoad=true and SuccessfulExit=false so it restarts on both login and abnormal exit, running as a background process type with stdout/stderr redirected to /dev/null. It self-copies to ~/Library/Caches/com.apple.crashreporter/ for the persistent execution path.
The binary employs several anti-a
Target sectors: technology, finance, cryptocurrency, general enterprise
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 32 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1588, T1585, T1587, T1195, T1204, T1059, T1204, T1543, T1027