# CrashStealer: Native C++ macOS Infostealer Masquerading as Apple's CrashReporter via Notarized 'Werkbit' Dropper

> CrashStealer is a previously undocumented, native-C++ macOS infostealer distributed via a signed and Apple-notarized fake meeting-app installer ('Werkbit') that stages a second payload impersonating Apple's CrashReporter.app. It bypasses Gatekeeper using a valid Developer ID, locally validates the victim's login password before harvesting Keychain data, browser credentials/cookies, ~80 cryptocurrency wallet extensions, and 14 password managers, then exfiltrates AES-256-GCM-encrypted ZIP archives over libcurl to a hardcoded C2 IP. Jamf Threat Labs reports active in-the-wild attacks since early July 2026.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-08-17T17:39:31.488Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1274
- **ID:** TL-2026-1274
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CrashStealer is delivered through a disk image ('Werkbit.app') distributed from the domain werkbit[.]io, registered in June 2026 and gated behind a fake meeting PIN requirement to add legitimacy and evade automated sandboxing. Both the disk image and binary carry a valid Apple Developer ID (Emil Grigorov, Team ID WWB7JA7AQV) and passed Apple notarization, allowing the dropper to bypass Gatekeeper's unidentified-developer warning entirely. Victims are instructed to right-click and select 'Open,' after which the 'veltod' executable contacts a GitHub repository (github.com/mgothiclove/pkeys) to retrieve a hidden instruction file named 'sys.cache.' This file contains an obfuscated curl command that fetches a shell-script downloader from endpoint-api-v1[.]com, which in turn retrieves and stages the second-stage payload, 'CrashReporter.dmg,' into /private/tmp/.CrashReporter/. The mounted disk image reveals CrashReporter.app, using the bundle identifier com.apple.crashreporter and an Apple-style icon to impersonate the legitimate system crash-reporting utility.

Once launched, CrashReporter.app presents a fake macOS system password prompt to the victim, convincing them they are authorizing a legitimate operation. The malware validates the entered credential locally (observed use of the dscl command) before using it to unlock the login Keychain — Safari saved logins, Wi-Fi passwords, application credentials, cryptographic keys, certificates, and tokens. It then enumerates and harvests data from Chromium-family browsers (Chrome, Brave, Edge, Opera, Vivaldi, Whale) and Firefox, including profiles, cookies, saved logins, and extension data; roughly 80 cryptocurrency wallet browser extensions (MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, Backpack, and others); and 14 password manager applications/extensions (1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, RoboForm, and others). It additionally sweeps the victim's ~/Documents and ~/Downloads directories for files of interest, explicitly skipping large media files, installers, and system directories to reduce exfiltration volume and analyst suspicion.

Collected data is packaged into hidden ZIP archives and encrypted client-side with AES-256-GCM before exfiltration via libcurl to a hardcoded command-and-control IP address (179.43.166.242), which was exposed in earlier malware samples through an App Transport Security exception entry. For persistence, CrashStealer copies itself to ~/Library/Caches/com.apple.crashreporter/, re-signs the copy with a new ad hoc signature (rewriting code-signature data to change the file hash while preserving functionality and evading hash-based detection), strips extended attributes (e.g., com.apple.quarantine) to avoid re-triggering Gatekeeper, and installs a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist (label com.apple.crashreporter.helper) to survive reboots and re-launch at login.

The malware is implemented in native C++ rather than the AppleScript/Objective-C wrappers common among commodity macOS stealers (Atomic Stealer, MacSync Stealer, Phexia), and incorporates meaningful anti-analysis engineering: control-flow flattening, encrypted strings, and layered/multiple anti-debugging and debugger-detection checks. It also actively surveys the host for endpoint protection agents, malware-analysis tooling, and virtualization/sandbox artifacts before proceeding with the harvesting routine, using legitimate macOS system utilities to blend in with normal process activity.

Jamf Threat Labs identified related infrastructure suggesting a broader, multi-platform social-engineering campaign: a cluster of lookalike fake meeting/collaboration-app domains (styled after 'Cohezo,' 'Cordinex,' 'Synerix,' 'Collabox,' and 'Werknova') all sharing a common backend at icky-lyrical[.]com, indicating werkbit[.]io is one lure variant among several using the same distribution and C2 tooling. The earliest suspicious sample was observed on VirusTotal in early May 2026 during what appears to be a development/testing phase, with confirmed active attacks against Jamf customer Macs beginning in early July 2026. Following Jamf's disclosure, Apple revoked the Developer ID signing credentials associated with the malicious application.

## MITRE ATT&CK

- T1566 Phishing
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1546 Event Triggered Execution
- T1140 Deobfuscate/Decode Files or Information
- T1553 Subvert Trust Controls
- T1036 Masquerading
- T1070 Indicator Removal
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1222 File and Directory Permissions Modification
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1518 Software Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1588 Obtain Capabilities
- T1622 Debugger Evasion
- T1564.001 Hide Artifacts: Hidden Files and Directories

## Sources

- [New CrashStealer malware poses as Apple crash reporting tool](https://www.bleepingcomputer.com/news/security/new-crashstealer-malware-poses-as-apple-crash-reporting-tool/)
- [CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks](https://thehackernews.com/2026/07/crashstealer-macos-malware-uses.html)
- [Jamf Threat Labs releases analysis of macOS info stealer dubbed 'CrashStealer'](https://www.mactech.com/2026/07/13/jamf-threat-labs-releases-analysis-of-macos-info-stealer-dubbed-crashstealer/)
- ['CrashStealer' malware poses as an Apple tool to steal passwords & Mac data](https://appleinsider.com/articles/26/07/13/crashstealer-malware-poses-as-an-apple-tool-to-steal-passwords-mac-data)
- [Jamf Threat Labs](https://www.jamf.com/threat-labs/)
- [DigitStealer: In-Depth Analysis of a New macOS Infostealer (related Jamf research on comparable stealer family)](https://www.jamf.com/blog/jtl-digitstealer-macos-infostealer-analysis/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1274