CrashStealer (detected as MacOS.Stealer.Crash) is a macOS information-stealer first observed on VirusTotal in early May 2026 in an apparently unfinished state, with confirmed in-the-wild deployment by early July 2026. The malware is delivered through a multi-stage chain: a signed and Apple-notarized disk image named 'Werkbit.app' ('Werkbit Setup'), distributed from the fake software site werkbit[.]io (registered late June 2026), gates its download behind a meeting PIN — a mechanism that limits exposure to invited/targeted victims and frustrates automated analysis and crawling by security vendors. The dropper (bundle ID dev.golove.velto, binary 'veltod') is signed with a valid Apple Developer ID belonging to 'Emil Grigorov' (Team ID WWB7JA7AQV) and carries a legitimate Apple notarization ticket, allowing it to pass Gatekeeper without an unidentified-developer warning. Apple has since revoked the associated signing credentials after Jamf Threat Labs disclosed the campaign.

Once launched, the dropper contacts a GitHub repository (github.com/mgothiclove/pkeys) to retrieve a staged file ('sys.cache') containing curl commands that fetch a shell script. That script downloads the second-stage payload disk image over cleartext HTTP from endpoint-api-v1[.]com/d/f1b24e/download, saving it as CrashReporter.dmg to /private/tmp/.CrashReporter/CrashReporter.app/Contents/MacOS/. The payload masquerades as Apple's crash-reporting utility, using bundle ID com.apple.crashreporter, the legitimate tool's icon and metadata, and the app name 'CrashReporter.app' to appear trustworthy.

On execution, CrashStealer displays a fake macOS system password prompt designed to resemble a legitimate administrator-privilege authorization dialog. When the victim enters their password, the malware validates it locally and offline using the macOS Directory Service command-line utility ('dscl -authonly'), caching the validated credential at ~/.cache/.sys_auth (mode 600); an incorrect password produces a fake authentication error and re-prompts the victim, closely mimicking real macOS behavior. Once validated, the captured local account password is used to unlock the user's Keychain — macOS's encrypted secret store containing Safari logins, Wi-Fi passwords, application passwords, private cryptographic keys, certificates, and access tokens.

CrashStealer then harvests browser profile data (login databases, cookies, autofill data) from nine Chromium-based browsers (Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, NAVER Whale) plus Firefox, targets roughly 80 cryptocurrency wallet browser extensions (including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, and Backpack), and 14 desktop/browser password managers (1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm, among others). It additionally sweeps user-writable locations such as ~/Documents and ~/Downloads for small files of interest, while deliberately skipping system/cache directories (Caches, Logs, Trash, .Trash, CrashReporter, DiagnosticReports, WebKit, Saved Application State, nsurlsessiond, bird, node_modules, __pycache__, .git) and executable/library/archive/media file types to avoid collecting noise or detection artifacts.

Harvested items are organized into staging subdirectories under ~/.cache/com.apple.crashreporter/ using prefixes '.brw_' (browser data), '.ext_' (wallet/extension data), and '.sw_' (password manager/software data), individually encrypted per-file, then packaged into ZIP archives named in the pattern '.zx_[8-hex-chars].zip'. Encryption uses AES-256-GCM via Apple's native CommonCrypto framework, with keys derived through PBKDF2-HMAC-SHA256 over 10,000 iterations and a hardcoded salt constant ('panel_salt_v1'). Exfiltration is performed via libcurl using its multipart form-data interface, initially over cleartext HTTP and later HTTPS, to a hardcoded C2 IP address (179.43.166.242) allow-listed through an App Transport Security (ATS) exception baked into the payload's Info.plist. Operators manage compromised hosts through a web panel at hxxps://endpoint-api-v1[.]com/login.

Persistence is established via a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist (label com.apple.crashreporter.helper), configured with RunAtLoad=true and SuccessfulExit=false so the agent relaunches the stealer after any unsuccessful exit, ensuring the malware survives reboots and remains active across sessions; the malware also re-signs its own binary to keep its code signature valid after modification.

CrashStealer incorporates layered anti-analysis defenses typical of a maturing commercial-grade stealer: multiple sysctl-based debugger-detection checks (querying KERN_PROC / P_TRACED, exiting with code 45 if a debugger is attached), control-flow flattening using dispatch blocks and jump tables to hinder static analysis, and runtime string decryption for sensitive strings stored in the binary's __const section. Related attacker-controlled infrastructure identified alongside werkbit[.]io includes the domains cohezo[.]io, cohezo[.]com, and cordinex[.]io, suggesting a broader distribution network beyond the single observed campaign.