CrashStealer: Signed & Notarized macOS Infostealer Delivered via Fake Meeting App "Werkbit"

CrashStealer (TL-2026-1273), also tracked as Werkbit, is a high-severity malware campaign, first published 2026-07-13. It has no confirmed attribution, affects Apple macOS, maps to 27 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 32 indicators of compromise.

Key facts for TL-2026-1273

Threat ID
TL-2026-1273
Also known as
Werkbit, CrashReporter malware, Werkbit Setup
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-13
Last reviewed
2026-07-13
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, finance, cryptocurrency, general enterprise
Target regions
Global
Detection rules
9
Indicators of compromise
32

Malware and tooling in CrashStealer

Malware and tooling: CrashStealer, Werkbit

CrashStealer is a native C++ macOS infostealer distributed as a signed, Apple-notarized disk image ("Werkbit Setup") from the PIN-gated domain werkbit[.]io. After a multi-stage GitHub-relayed download chain it drops CrashReporter.dmg impersonating Apple's crash-reporting framework, locally validates the victim's login password via dscl, then harvests browser data, ~80 cryptocurrency wallet extensions, 14 password managers, and Keychain material, AES-256-GCM-encrypts it, and exfiltrates it via libcurl multipart uploads to a hardcoded C2 IP.

How CrashStealer works

CrashStealer, documented by Jamf Threat Labs (researcher Thijs Xhaflaire) and reported by The Hacker News on 2026-07-13, is a native C++ macOS information stealer notable for reaching victims through a signed and Apple-notarized dropper — a technique that bypasses Gatekeeper's default unsigned/unnotarized-code blocking entirely. The initial lure, "Werkbit," is presented as a meeting/collaboration application distributed from werkbit[.]io, a domain registered in late June 2026, close to the malware's build date. Access to the installer disk image is gated behind a meeting PIN, meaning the file is served only to targets who receive the code directly rather than to any site visitor or automated scanner — a deliberate anti-analysis and targeting control.

The dropper, signed under Developer ID "Emil Grigorov" (Team ID WWB7JA7AQV, bundle identifier dev.golove.velto) as a universal (arm64/x86_64) binary with hardened runtime and a stapled notarization ticket, launches an executable named "veltod." This binary retrieves a hidden instruction file (sys.cache) from the GitHub repository mgothiclove/pkeys, which directs it to fetch an obfuscated shell script from endpoint-api-v1[.]com. That script downloads CrashReporter.dmg to /private/tmp/.CrashReporter/, strips the original code signature (codesign --remove-signature) and re-applies an ad-hoc signature (codesign -s - --force --deep --no-strict), removes the quarantine attribute (xattr -cr), and mounts the disk image with hdiutil using -nobrowse -noverify -noautoopen -quiet before launching the payload — CrashReporter.app, which impersonates Apple's built-in crash-reporting component via bundle identifier com.apple.crashreporter, an Apple-style icon, and matching display name.

Once running, CrashStealer presents a fake system password prompt and validates the entered credential locally using the legitimate dscl -authonly command, re-prompting on failure, before proceeding to harvest data. It targets Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, NAVER Whale, and Firefox (profiles, cookies, saved logins, extension storage); approximately 80 cryptocurrency wallet browser extensions spanning MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, Backpack, and Solana/Cosmos/TON/Sui/Aptos/NEO-ecosystem wallets; 14 password managers including 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm; the macOS login keychain (login.keychain-db); and files under ~/Documents, ~/Downloads, and ~/Desktop. It also performs security/analysis-tool discovery to detect monitoring software.

Collected data is staged under ~/.cache/com.apple.crashreporter/, with password material additionally cached in an obfuscated (not encrypted) file at ~/.cache/.sys_auth. Each collected file is individually encrypted with AES-256-GCM via Apple's CommonCrypto framework, using a PBKDF2-HMAC-SHA256 key derivation (10,000 iterations) and a hardcoded salt constant "panel_salt_v1" that appears to be an unremoved development default. Encrypted files (~8.0 bits/byte entropy, no readable headers) are packed into hidden ZIP archives named with the pattern .zx_[8-hex-chars].zip and exfiltrated via libcurl multipart form uploads (curl_mime) to the hardcoded C2 IP address 179.43.166.242, which was exposed in earlier development samples via an App Transport Security exception entry in Info.plist. Staging directories are deleted post-exfiltration, though the .zx_*.zip archives may persist on disk.

For persistence, CrashStealer installs a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist with label com.apple.crashreporter.helper, RunAtLoad=true and SuccessfulExit=false so it restarts on both login and abnormal exit, running as a background process type with stdout/stderr redirected to /dev/null. It self-copies to ~/Library/Caches/com.apple.crashreporter/ for the persistent execution path.

The binary employs several anti-analysis techniques: control-flow flattening (functions restructured through dispatch blocks and jump tables to obstruct reverse engineering), string encryption in the __const section decoded at runtime via a byte-substitution routine, and layered anti-debugging — a primary sysctl(KERN_PROC, P_TRACED) check during dynamic-linker initialization that exits with code 45 if a debugger is attached, plus a secondary validation check during application initialization.

Jamf identified related attacker-controlled infrastructure including operator login panels at endpoint-api-v1[.]com/login, and additional domains cohezo[.]io, cohezo[.]com, and cordinex[.]io, alongside lookalike naming patterns (Cohezo, Cordinex, Synerix, Collabox, Werknova variants) suggesting a broader campaign of similarly-branded fake meeting/collaboration apps. Following Jamf's disclosure, Apple revoked the Emil Grigorov Developer ID certificate used to sign the dropper and payload.

MITRE ATT&CK techniques used in TL-2026-1273

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts; T1622 Debugger Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel

Credential Access

T1056 Input Capture; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Initial Access

T1195 Supply Chain Compromise

execution

T1204 User Execution

Persistence

T1543 Create or Modify System Process

defense-impairment

T1553 Subvert Trust Controls

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities

Affected products and versions in CrashStealer

  • Apple — macOS
    Vulnerable versions: all supported macOS versions accepting notarized third-party applications

Remediation for CrashStealer

Immediate actions

  • Block network access to werkbit[.]io, endpoint-api-v1[.]com, icky-lyrical[.]com, cohezo[.]io, cohezo[.]com, cordinex[.]io, and IP 179.43.166.242 at DNS/firewall/proxy
  • Search endpoint fleet for LaunchAgent ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist and bundle identifier com.apple.crashreporter across all users
  • Search for /private/tmp/.CrashReporter/, ~/.cache/com.apple.crashreporter/, ~/Library/Caches/com.apple.crashreporter/, ~/.cache/.sys_auth, and *.zx_*.zip archives
  • Revoke and rotate credentials for any browser-saved logins, password-manager vaults, and cryptocurrency wallets on affected Macs
  • Quarantine and forensically image any host where CrashReporter.app or the veltod binary is found before remediation

Workarounds

  • Restrict installation of unmanaged, non-MDM-distributed macOS applications via endpoint management policy
  • Report the Developer ID (Emil Grigorov / Team ID WWB7JA7AQV) to Apple for continued revocation monitoring if re-signed variants appear

Longer-term hardening

  • Deploy EDR/XDR with behavioral detection for LaunchAgent creation, code re-signing (codesign --remove-signature followed by ad-hoc re-sign), and xattr -cr quarantine-attribute removal
  • Enforce application allow-listing / notarization-ticket verification beyond Gatekeeper defaults, since this campaign demonstrates a valid notarized-and-signed bypass
  • User awareness training on PIN-gated / invite-only software downloads as a targeting and evasion technique
  • Monitor for anomalous dscl -authonly invocations by non-system processes as a signal of local credential-harvesting prompts

Timeline of CrashStealer

  • An early CrashStealer development sample first surfaces on VirusTotal, per Jamf Threat Labs, containing the hardcoded C2 IP 179.43.166.242 exposed via an App Transport Security exception in Info.plist.
  • The delivery domain werkbit[.]io is registered in late June 2026, close to the malware's build date, ahead of the fake 'Werkbit' meeting-app campaign launch.
  • CrashStealer transitions from development to active in-the-wild deployment, with detections observed in early July 2026 via the PIN-gated Werkbit.io distribution chain.
  • MalwareHunterTeam independently discovers and publicizes the CrashStealer operator command panel at endpoint-api-v1[.]com/login via social media (X/Twitter), ahead of Jamf's full public disclosure.
  • Jamf Threat Labs privately shares its findings, including the abused Developer ID (Emil Grigorov, Team ID WWB7JA7AQV), with Apple's security team ahead of public disclosure.
  • During infrastructure analysis, Jamf Threat Labs identifies a Windows installer hosted alongside the macOS Werkbit distribution, indicating CrashStealer is part of a broader cross-platform operation rather than a macOS-only campaign.
  • The Hacker News, AppleInsider, and MacTech.com publish coverage summarizing the Jamf Threat Labs findings, broadening public awareness of the campaign.
  • Following Jamf's coordinated disclosure, Apple revokes the Developer ID certificate (Emil Grigorov, Team ID WWB7JA7AQV) used to sign the Werkbit dropper and CrashReporter payload.
  • Jamf Threat Labs (researcher Thijs Xhaflaire) publishes a full technical analysis of CrashStealer, detailing the notarized dropper, GitHub-relayed staging chain, CrashReporter impersonation, and data-harvesting capabilities.

Sources cited for CrashStealer

Threats related to CrashStealer

Detection coverage for TL-2026-1273

As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1273 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1273

4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats