# CrashStealer: Signed & Notarized macOS Infostealer Delivered via Fake Meeting App "Werkbit"

> CrashStealer is a native C++ macOS infostealer distributed as a signed, Apple-notarized disk image ("Werkbit Setup") from the PIN-gated domain werkbit[.]io. After a multi-stage GitHub-relayed download chain it drops CrashReporter.dmg impersonating Apple's crash-reporting framework, locally validates the victim's login password via dscl, then harvests browser data, ~80 cryptocurrency wallet extensions, 14 password managers, and Keychain material, AES-256-GCM-encrypts it, and exfiltrates it via libcurl multipart uploads to a hardcoded C2 IP.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1273
- **ID:** TL-2026-1273
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CrashStealer, documented by Jamf Threat Labs (researcher Thijs Xhaflaire) and reported by The Hacker News on 2026-07-13, is a native C++ macOS information stealer notable for reaching victims through a signed and Apple-notarized dropper — a technique that bypasses Gatekeeper's default unsigned/unnotarized-code blocking entirely. The initial lure, "Werkbit," is presented as a meeting/collaboration application distributed from werkbit[.]io, a domain registered in late June 2026, close to the malware's build date. Access to the installer disk image is gated behind a meeting PIN, meaning the file is served only to targets who receive the code directly rather than to any site visitor or automated scanner — a deliberate anti-analysis and targeting control.

The dropper, signed under Developer ID "Emil Grigorov" (Team ID WWB7JA7AQV, bundle identifier dev.golove.velto) as a universal (arm64/x86_64) binary with hardened runtime and a stapled notarization ticket, launches an executable named "veltod." This binary retrieves a hidden instruction file (sys.cache) from the GitHub repository mgothiclove/pkeys, which directs it to fetch an obfuscated shell script from endpoint-api-v1[.]com. That script downloads CrashReporter.dmg to /private/tmp/.CrashReporter/, strips the original code signature (codesign --remove-signature) and re-applies an ad-hoc signature (codesign -s - --force --deep --no-strict), removes the quarantine attribute (xattr -cr), and mounts the disk image with hdiutil using -nobrowse -noverify -noautoopen -quiet before launching the payload — CrashReporter.app, which impersonates Apple's built-in crash-reporting component via bundle identifier com.apple.crashreporter, an Apple-style icon, and matching display name.

Once running, CrashStealer presents a fake system password prompt and validates the entered credential locally using the legitimate dscl -authonly command, re-prompting on failure, before proceeding to harvest data. It targets Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, NAVER Whale, and Firefox (profiles, cookies, saved logins, extension storage); approximately 80 cryptocurrency wallet browser extensions spanning MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, Backpack, and Solana/Cosmos/TON/Sui/Aptos/NEO-ecosystem wallets; 14 password managers including 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm; the macOS login keychain (login.keychain-db); and files under ~/Documents, ~/Downloads, and ~/Desktop. It also performs security/analysis-tool discovery to detect monitoring software.

Collected data is staged under ~/.cache/com.apple.crashreporter/, with password material additionally cached in an obfuscated (not encrypted) file at ~/.cache/.sys_auth. Each collected file is individually encrypted with AES-256-GCM via Apple's CommonCrypto framework, using a PBKDF2-HMAC-SHA256 key derivation (10,000 iterations) and a hardcoded salt constant "panel_salt_v1" that appears to be an unremoved development default. Encrypted files (~8.0 bits/byte entropy, no readable headers) are packed into hidden ZIP archives named with the pattern .zx_[8-hex-chars].zip and exfiltrated via libcurl multipart form uploads (curl_mime) to the hardcoded C2 IP address 179.43.166.242, which was exposed in earlier development samples via an App Transport Security exception entry in Info.plist. Staging directories are deleted post-exfiltration, though the .zx_*.zip archives may persist on disk.

For persistence, CrashStealer installs a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist with label com.apple.crashreporter.helper, RunAtLoad=true and SuccessfulExit=false so it restarts on both login and abnormal exit, running as a background process type with stdout/stderr redirected to /dev/null. It self-copies to ~/Library/Caches/com.apple.crashreporter/ for the persistent execution path.

The binary employs several anti-analysis techniques: control-flow flattening (functions restructured through dispatch blocks and jump tables to obstruct reverse engineering), string encryption in the __const section decoded at runtime via a byte-substitution routine, and layered anti-debugging — a primary sysctl(KERN_PROC, P_TRACED) check during dynamic-linker initialization that exits with code 45 if a debugger is attached, plus a secondary validation check during application initialization.

Jamf identified related attacker-controlled infrastructure including operator login panels at endpoint-api-v1[.]com/login, and additional domains cohezo[.]io, cohezo[.]com, and cordinex[.]io, alongside lookalike naming patterns (Cohezo, Cordinex, Synerix, Collabox, Werknova variants) suggesting a broader campaign of similarly-branded fake meeting/collaboration apps. Following Jamf's disclosure, Apple revoked the Emil Grigorov Developer ID certificate used to sign the dropper and payload.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1553 Subvert Trust Controls
- T1070 Indicator Removal
- T1036 Masquerading
- T1564 Hide Artifacts
- T1622 Debugger Evasion
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1056 Input Capture
- T1518 Software Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1102 Web Service
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel

## Sources

- [CrashStealer macOS Malware Uses Signed, Notarized App to Steal Keychain and Wallet Data](https://thehackernews.com/2026/07/crashstealer-macos-malware-uses.html)
- [CrashStealer: macOS Infostealer Analysis](http://www.jamf.com/blog/crashstealer-macos-infostealer-analysis/)
- ['CrashStealer' malware poses as an Apple tool to steal passwords & Mac data](https://appleinsider.com/articles/26/07/13/crashstealer-malware-poses-as-an-apple-tool-to-steal-passwords-mac-data)
- [Jamf Threat Labs releases analysis of macOS info stealer dubbed 'CrashStealer'](https://www.mactech.com/2026/07/13/jamf-threat-labs-releases-analysis-of-macos-info-stealer-dubbed-crashstealer/)
- [Jamf Threat Labs — Cybersecurity experts and data scientists](https://www.jamf.com/threat-labs/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1273