CrashStealer: Native C++ macOS Infostealer Masquerading as Apple's CrashReporter via Notarized 'Werkbit' Dropper — Threadlinqs Intelligence
As of 2026-07-13, CrashStealer: Native C++ macOS Infostealer Masquerading as Apple's CrashReporter via Notarized 'Werkbit' Dropper is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1274 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
CrashStealer is a previously undocumented, native-C++ macOS infostealer distributed via a signed and Apple-notarized fake meeting-app installer ('Werkbit') that stages a second payload impersonating
CrashStealer is delivered through a disk image ('Werkbit.app') distributed from the domain werkbit[.]io, registered in June 2026 and gated behind a fake meeting PIN requirement to add legitimacy and evade automated sandboxing. Both the disk image and binary carry a valid Apple Developer ID (Emil Grigorov, Team ID WWB7JA7AQV) and passed Apple notarization, allowing the dropper to bypass Gatekeeper's unidentified-developer warning entirely. Victims are instructed to right-click and select 'Open,' after which the 'veltod' executable contacts a GitHub repository (github.com/mgothiclove/pkeys) to retrieve a hidden instruction file named 'sys.cache.' This file contains an obfuscated curl command that fetches a shell-script downloader from endpoint-api-v1[.]com, which in turn retrieves and stages the second-stage payload, 'CrashReporter.dmg,' into /private/tmp/.CrashReporter/. The mounted disk image reveals CrashReporter.app, using the bundle identifier com.apple.crashreporter and an Apple-style icon to impersonate the legitimate system crash-reporting utility.
Once launched, CrashReporter.app presents a fake macOS system password prompt to the victim, convincing them they are authorizing a legitimate operation. The malware validates the entered credential locally (observed use of the dscl command) before using it to unlock the login Keychain — Safari saved logins, Wi-Fi passwords, application credentials, cryptographic keys, certificates, and tokens. It then enumerates and harvests data from Chromium-family browsers (Chrome, Brave, Edge, Opera, Vivaldi, Whale) and Firefox, including profiles, cookies, saved logins, and extension data; roughly 80 cryptocurrency wallet browser extensions (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, Backpack, and others); and 14 password manager applications/extensions (1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, RoboForm, and others). It additionally sweeps the victim's ~/Documents and ~/Downloads directories for files of interest, explicitly skipping large media files, installers, and system directories to reduce exfiltration volume and analyst suspicion.
Collected data is packaged into hidden ZIP archives and encrypted client-side with AES-256-GCM before exfiltration via libcurl to a hardcoded command-and-control IP address (179.43.166.242), which was exposed in earlier malware samples through an App Transport Security exception entry. For persistence, CrashStealer copies itself to ~/Library/Caches/com.apple.crashreporter/, re-signs the copy with a new ad hoc signature (rewriting code-signature data to change the file hash while preserving functionality and evading hash-based detection), strips extended attributes (e.g., com.apple.quarantine) to avoid re-triggering Gatekeeper, and installs a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist (label com.apple.crashreporter.helper) to survive reboots and re-launch at login.
The malware is implemented in native C++ rather than the AppleScript/Objective-C wrappers common among commodity macOS stealers (Atomic Stealer, MacSync Stealer, Phexia), and incorporates meaningful anti-analysis engineering: control-flow flattening, encrypted strings, and layered/multiple anti-debugging and debugger-detection checks. It also actively surveys the host for endpoint protection agents, malware-analysis tooling, and virtualization/sandbox artifacts before proceeding with the harvesting routine, using legitimate macOS system utilities to blend in with normal process activity.
Jamf Threat Labs identified related infrastructure suggesting a broader, multi-platform social-engineering campaign: a cluster of lookalike fake meeting/collaboration-app domains (styled after 'Cohezo,' 'Cordinex,' 'Synerix,' 'Collabox,' and 'Werknova') all sharing a common backend at icky-lyrical[.]com, indicating werkbit[.]io is one lure variant among several using the same distributio
Target sectors: cryptocurrency, technology, finance, general enterprise, consumer
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1195, T1204, T1059, T1547, T1546, T1140, T1553, T1036, T1070