CrashStealer: Notarized Fake Apple CrashReporter App Steals macOS Keychain, Browser, and Crypto Wallet Credentials — Threadlinqs Intelligence
As of 2026-07-15, CrashStealer: Notarized Fake Apple CrashReporter App Steals macOS Keychain, Browser, and Crypto Wallet Credentials is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1358 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
CrashStealer is a C++ macOS information-stealer that impersonates Apple's CrashReporter component to trick users into revealing their local system password, then unlocks the Keychain and exfiltrates
CrashStealer (detected as MacOS.Stealer.Crash) is a macOS information-stealer first observed on VirusTotal in early May 2026 in an apparently unfinished state, with confirmed in-the-wild deployment by early July 2026. The malware is delivered through a multi-stage chain: a signed and Apple-notarized disk image named 'Werkbit.app' ('Werkbit Setup'), distributed from the fake software site werkbit[.]io (registered late June 2026), gates its download behind a meeting PIN — a mechanism that limits exposure to invited/targeted victims and frustrates automated analysis and crawling by security vendors. The dropper (bundle ID dev.golove.velto, binary 'veltod') is signed with a valid Apple Developer ID belonging to 'Emil Grigorov' (Team ID WWB7JA7AQV) and carries a legitimate Apple notarization ticket, allowing it to pass Gatekeeper without an unidentified-developer warning. Apple has since revoked the associated signing credentials after Jamf Threat Labs disclosed the campaign.
Once launched, the dropper contacts a GitHub repository (github.com/mgothiclove/pkeys) to retrieve a staged file ('sys.cache') containing curl commands that fetch a shell script. That script downloads the second-stage payload disk image over cleartext HTTP from endpoint-api-v1[.]com/d/f1b24e/download, saving it as CrashReporter.dmg to /private/tmp/.CrashReporter/CrashReporter.app/Contents/MacOS/. The payload masquerades as Apple's crash-reporting utility, using bundle ID com.apple.crashreporter, the legitimate tool's icon and metadata, and the app name 'CrashReporter.app' to appear trustworthy.
On execution, CrashStealer displays a fake macOS system password prompt designed to resemble a legitimate administrator-privilege authorization dialog. When the victim enters their password, the malware validates it locally and offline using the macOS Directory Service command-line utility ('dscl -authonly'), caching the validated credential at ~/.cache/.sys_auth (mode 600); an incorrect password produces a fake authentication error and re-prompts the victim, closely mimicking real macOS behavior. Once validated, the captured local account password is used to unlock the user's Keychain — macOS's encrypted secret store containing Safari logins, Wi-Fi passwords, application passwords, private cryptographic keys, certificates, and access tokens.
CrashStealer then harvests browser profile data (login databases, cookies, autofill data) from nine Chromium-based browsers (Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, NAVER Whale) plus Firefox, targets roughly 80 cryptocurrency wallet browser extensions (including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, and Backpack), and 14 desktop/browser password managers (1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm, among others). It additionally sweeps user-writable locations such as ~/Documents and ~/Downloads for small files of interest, while deliberately skipping system/cache directories (Caches, Logs, Trash, .Trash, CrashReporter, DiagnosticReports, WebKit, Saved Application State, nsurlsessiond, bird, node_modules, __pycache__, .git) and executable/library/archive/media file types to avoid collecting noise or detection artifacts.
Harvested items are organized into staging subdirectories under ~/.cache/com.apple.crashreporter/ using prefixes '.brw_' (browser data), '.ext_' (wallet/extension data), and '.sw_' (password manager/software data), individually encrypted per-file, then packaged into ZIP archives named in the pattern '.zx_[8-hex-chars].zip'. Encryption uses AES-256-GCM via Apple's native CommonCrypto framework, with keys derived through PBKDF2-HMAC-SHA256 over 10,000 iterations and a hardcoded salt constant ('panel_salt_v1'). Exfiltration is performed via libcurl using its multipart form-data interface, initially over cleartext HTTP and later HTTPS, to a hardcoded C2 IP address (179.43.166.242) allow-listed thr
Target sectors: technology, cryptocurrency, general consumer individual macos users
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1189, T1204.002, T1059.004, T1543.001, T1547.015, T1036.005, T1553.002, T1218, T1027, T1140