CrashStealer: Native C++ macOS Infostealer Masquerading as Apple's CrashReporter via Notarized 'Werkbit' Dropper
CrashStealer (TL-2026-1274), also tracked as Werkbit, is a high-severity malware campaign, first published 2026-07-13 and last reviewed 2026-08-17. It has no confirmed attribution, affects Apple macOS, maps to 34 MITRE ATT&CK techniques (T1005, T1020, T1027), and is covered by 9 detection rules and 35 indicators of compromise.
Key facts for TL-2026-1274
- Threat ID
- TL-2026-1274
- Also known as
- Werkbit
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-13
- Last reviewed
- 2026-08-17
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, technology, finance, general enterprise, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 35
- Updates
- 2026-08-17 · revalidated 1× · latest source
Malware and tooling in CrashStealer
Malware and tooling: CrashStealer
CrashStealer is a previously undocumented, native-C++ macOS infostealer distributed via a signed and Apple-notarized fake meeting-app installer ('Werkbit') that stages a second payload impersonating Apple's CrashReporter.app. It bypasses Gatekeeper using a valid Developer ID, locally validates the victim's login password before harvesting Keychain data, browser credentials/cookies, ~80 cryptocurrency wallet extensions, and 14 password managers, then exfiltrates AES-256-GCM-encrypted ZIP archives over libcurl to a hardcoded C2 IP. Jamf Threat Labs reports active in-the-wild attacks since early July 2026.
How CrashStealer works
CrashStealer is delivered through a disk image ('Werkbit.app') distributed from the domain werkbit[.]io, registered in June 2026 and gated behind a fake meeting PIN requirement to add legitimacy and evade automated sandboxing. Both the disk image and binary carry a valid Apple Developer ID (Emil Grigorov, Team ID WWB7JA7AQV) and passed Apple notarization, allowing the dropper to bypass Gatekeeper's unidentified-developer warning entirely. Victims are instructed to right-click and select 'Open,' after which the 'veltod' executable contacts a GitHub repository (github.com/mgothiclove/pkeys) to retrieve a hidden instruction file named 'sys.cache.' This file contains an obfuscated curl command that fetches a shell-script downloader from endpoint-api-v1[.]com, which in turn retrieves and stages the second-stage payload, 'CrashReporter.dmg,' into /private/tmp/.CrashReporter/. The mounted disk image reveals CrashReporter.app, using the bundle identifier com.apple.crashreporter and an Apple-style icon to impersonate the legitimate system crash-reporting utility.
Once launched, CrashReporter.app presents a fake macOS system password prompt to the victim, convincing them they are authorizing a legitimate operation. The malware validates the entered credential locally (observed use of the dscl command) before using it to unlock the login Keychain — Safari saved logins, Wi-Fi passwords, application credentials, cryptographic keys, certificates, and tokens. It then enumerates and harvests data from Chromium-family browsers (Chrome, Brave, Edge, Opera, Vivaldi, Whale) and Firefox, including profiles, cookies, saved logins, and extension data; roughly 80 cryptocurrency wallet browser extensions (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, Backpack, and others); and 14 password manager applications/extensions (1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, RoboForm, and others). It additionally sweeps the victim's ~/Documents and ~/Downloads directories for files of interest, explicitly skipping large media files, installers, and system directories to reduce exfiltration volume and analyst suspicion.
Collected data is packaged into hidden ZIP archives and encrypted client-side with AES-256-GCM before exfiltration via libcurl to a hardcoded command-and-control IP address (179.43.166.242), which was exposed in earlier malware samples through an App Transport Security exception entry. For persistence, CrashStealer copies itself to ~/Library/Caches/com.apple.crashreporter/, re-signs the copy with a new ad hoc signature (rewriting code-signature data to change the file hash while preserving functionality and evading hash-based detection), strips extended attributes (e.g., com.apple.quarantine) to avoid re-triggering Gatekeeper, and installs a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist (label com.apple.crashreporter.helper) to survive reboots and re-launch at login.
The malware is implemented in native C++ rather than the AppleScript/Objective-C wrappers common among commodity macOS stealers (Atomic Stealer, MacSync Stealer, Phexia), and incorporates meaningful anti-analysis engineering: control-flow flattening, encrypted strings, and layered/multiple anti-debugging and debugger-detection checks. It also actively surveys the host for endpoint protection agents, malware-analysis tooling, and virtualization/sandbox artifacts before proceeding with the harvesting routine, using legitimate macOS system utilities to blend in with normal process activity.
Jamf Threat Labs identified related infrastructure suggesting a broader, multi-platform social-engineering campaign: a cluster of lookalike fake meeting/collaboration-app domains (styled after 'Cohezo,' 'Cordinex,' 'Synerix,' 'Collabox,' and 'Werknova') all sharing a common backend at icky-lyrical[.]com, indicating werkbit[.]io is one lure variant among several using the same distribution and C2 tooling. The earliest suspicious sample was observed on VirusTotal in early May 2026 during what appears to be a development/testing phase, with confirmed active attacks against Jamf customer Macs beginning in early July 2026. Following Jamf's disclosure, Apple revoked the Developer ID signing credentials associated with the malicious application.
MITRE ATT&CK techniques used in TL-2026-1274
Collection
T1005 Data from Local System; T1074 Data Staged; T1560 Archive Collected Data
Exfiltration
T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564.001 Hide Artifacts: Hidden Files and Directories; T1622 Debugger Evasion
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
Initial Access
T1195 Supply Chain Compromise; T1566 Phishing
defense-impairment
T1222 File and Directory Permissions Modification; T1553 Subvert Trust Controls
Persistence
T1546 Event Triggered Execution; T1547 Boot or Logon Autostart Execution
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1588 Obtain Capabilities
Affected products and versions in CrashStealer
- Apple — macOS
Vulnerable versions: all supported macOS versions accepting notarized third-party applications
Remediation for CrashStealer
Patches
- No CVE/vendor patch applicable — this is a malware-delivery threat, not a software vulnerability
Immediate actions
- Block network traffic to werkbit[.]io, endpoint-api-v1[.]com, icky-lyrical[.]com, and IP 179.43.166.242 at perimeter/DNS/proxy layers
- Search endpoint fleets for the LaunchAgent ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist and bundle identifier com.apple.crashreporter
- Quarantine and remove any application at ~/Library/Caches/com.apple.crashreporter/ or /private/tmp/.CrashReporter/
- Revoke/rotate credentials stored in Keychain, browser password managers, and any of the 14 targeted password managers on affected Macs
- Migrate cryptocurrency funds from wallets present in any of the ~80 targeted wallet extensions on affected Macs to new, uncompromised wallets
- Block execution of applications signed with Developer ID / Team ID WWB7JA7AQV (Emil Grigorov) via Gatekeeper/MRT or MDM code-signing policy
Workarounds
- Disable automatic mounting/opening of downloaded disk images from unmanaged sources
- Restrict local admin rights to reduce the malware's ability to obtain Keychain-unlock credentials via fake password prompts
Longer-term hardening
- Deploy EDR with behavioral detection for macOS covering Keychain access APIs, browser credential-store file access, and LaunchAgent creation events
- Enforce MDM policies restricting installation of unnotarized/newly-notarized third-party 'meeting app' software outside an approved allowlist
- Implement egress filtering/DNS monitoring for newly registered domains contacted by unmanaged consumer software
- User awareness training on fake system password prompts and 'right-click > Open' Gatekeeper-bypass social engineering
- Monitor GitHub for delivery infrastructure patterns (hidden instruction files in unrelated public repos) as a detection signal
Timeline of CrashStealer
- Earliest suspicious CrashStealer-related sample spotted on VirusTotal, indicating an active development/testing phase for the malware.
- The werkbit[.]io distribution domain is registered, later used to host the notarized 'Werkbit' dropper disk image.
- Jamf Threat Labs notes the CrashStealer binary's compile/build timestamp falls close to the werkbit[.]io domain registration date in late June 2026, indicating the dropper infrastructure and payload were finalized together shortly before the campaign's launch.
- Jamf Threat Labs observes CrashStealer samples matching customer Mac telemetry, marking the start of confirmed active in-the-wild attacks.
- Jamf researchers identify a cluster of lookalike fake meeting/collaboration-app domains (Cohezo, Cordinex, Synerix, Collabox, Werknova-styled names) sharing backend infrastructure at icky-lyrical[.]com.
- Following disclosure of findings to Apple, the Developer ID / Team ID (WWB7JA7AQV, Emil Grigorov) used to sign the malicious Werkbit and CrashReporter applications is revoked.
- TL-Intel-Harness HUNT phase ingests the BleepingComputer report and opens threat TL-2026-1274 for research.
- Jamf Threat Labs publishes its technical analysis of CrashStealer; BleepingComputer, The Hacker News, AppleInsider, and MacTech publish coverage the same day.
- Help Net Security and Infosecurity Magazine publish coverage of CrashStealer, expanding on Jamf's original disclosure.
- MacRumors publishes coverage of CrashStealer for a mainstream Apple-user audience.
Update history for TL-2026-1274
- 2026-08-17 — CrashStealer: Notarized macOS Infostealer Masquerading as Apple's Crash Reporter: What changed No severity/exploitability/status escalation — both reports independently assess HIGH severity, ACTIVE exploitability and status. This report adds operator infrastructure and technical specificity rather than changing the threa
Sources cited for CrashStealer
- New CrashStealer malware poses as Apple crash reporting tool
- CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks
- Jamf Threat Labs releases analysis of macOS info stealer dubbed 'CrashStealer'
- 'CrashStealer' malware poses as an Apple tool to steal passwords & Mac data
- Jamf Threat Labs
- DigitStealer: In-Depth Analysis of a New macOS Infostealer (related Jamf research on comparable stealer family)
Threats related to CrashStealer
- CrashStealer: Signed & Notarized macOS Infostealer Delivered via Fake Meeting App "Werkbit"
- CrashStealer: Native C++ macOS Infostealer Impersonating Apple's CrashReporter, Delivered via Notarized "Werkbit" Meeting-App Lure
- CrashStealer: Novel macOS Information Stealer Disguised as Apple Crash Reporter (Jamf Threat Labs)
- CrashStealer: Notarized Fake Apple CrashReporter App Steals macOS Keychain, Browser, and Crypto Wallet Credentials
- Operation Endgame Disrupts Amadey Loader and StealC Infostealer Malware-as-a-Service Infrastructure (CVE: N/A)
- SHub Stealer "Reaper" — macOS Infostealer Using applescript:// URL-Scheme Delivery, Filegrabber Module, and Google-Masquerading LaunchAgent Backdoor
Detection coverage for TL-2026-1274
As of 2026-08-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1274 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1274
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.