# CrashStealer: Notarized Fake Apple CrashReporter App Steals macOS Keychain, Browser, and Crypto Wallet Credentials

> CrashStealer is a C++ macOS information-stealer that impersonates Apple's CrashReporter component to trick users into revealing their local system password, then unlocks the Keychain and exfiltrates browser credentials, cookies, ~80 cryptocurrency wallet extensions, and 14 password managers' data. It is distributed via a signed, Apple-notarized dropper ('Werkbit Setup'/Werkbit.app) served from a PIN-gated fake software site (werkbit[.]io) registered in late June 2026, indicating a targeted, invitation-only campaign.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1358
- **ID:** TL-2026-1358
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CrashStealer (detected as MacOS.Stealer.Crash) is a macOS information-stealer first observed on VirusTotal in early May 2026 in an apparently unfinished state, with confirmed in-the-wild deployment by early July 2026. The malware is delivered through a multi-stage chain: a signed and Apple-notarized disk image named 'Werkbit.app' ('Werkbit Setup'), distributed from the fake software site werkbit[.]io (registered late June 2026), gates its download behind a meeting PIN — a mechanism that limits exposure to invited/targeted victims and frustrates automated analysis and crawling by security vendors. The dropper (bundle ID dev.golove.velto, binary 'veltod') is signed with a valid Apple Developer ID belonging to 'Emil Grigorov' (Team ID WWB7JA7AQV) and carries a legitimate Apple notarization ticket, allowing it to pass Gatekeeper without an unidentified-developer warning. Apple has since revoked the associated signing credentials after Jamf Threat Labs disclosed the campaign.

Once launched, the dropper contacts a GitHub repository (github.com/mgothiclove/pkeys) to retrieve a staged file ('sys.cache') containing curl commands that fetch a shell script. That script downloads the second-stage payload disk image over cleartext HTTP from endpoint-api-v1[.]com/d/f1b24e/download, saving it as CrashReporter.dmg to /private/tmp/.CrashReporter/CrashReporter.app/Contents/MacOS/. The payload masquerades as Apple's crash-reporting utility, using bundle ID com.apple.crashreporter, the legitimate tool's icon and metadata, and the app name 'CrashReporter.app' to appear trustworthy.

On execution, CrashStealer displays a fake macOS system password prompt designed to resemble a legitimate administrator-privilege authorization dialog. When the victim enters their password, the malware validates it locally and offline using the macOS Directory Service command-line utility ('dscl -authonly'), caching the validated credential at ~/.cache/.sys_auth (mode 600); an incorrect password produces a fake authentication error and re-prompts the victim, closely mimicking real macOS behavior. Once validated, the captured local account password is used to unlock the user's Keychain — macOS's encrypted secret store containing Safari logins, Wi-Fi passwords, application passwords, private cryptographic keys, certificates, and access tokens.

CrashStealer then harvests browser profile data (login databases, cookies, autofill data) from nine Chromium-based browsers (Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, NAVER Whale) plus Firefox, targets roughly 80 cryptocurrency wallet browser extensions (including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, and Backpack), and 14 desktop/browser password managers (1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm, among others). It additionally sweeps user-writable locations such as ~/Documents and ~/Downloads for small files of interest, while deliberately skipping system/cache directories (Caches, Logs, Trash, .Trash, CrashReporter, DiagnosticReports, WebKit, Saved Application State, nsurlsessiond, bird, node_modules, __pycache__, .git) and executable/library/archive/media file types to avoid collecting noise or detection artifacts.

Harvested items are organized into staging subdirectories under ~/.cache/com.apple.crashreporter/ using prefixes '.brw_' (browser data), '.ext_' (wallet/extension data), and '.sw_' (password manager/software data), individually encrypted per-file, then packaged into ZIP archives named in the pattern '.zx_[8-hex-chars].zip'. Encryption uses AES-256-GCM via Apple's native CommonCrypto framework, with keys derived through PBKDF2-HMAC-SHA256 over 10,000 iterations and a hardcoded salt constant ('panel_salt_v1'). Exfiltration is performed via libcurl using its multipart form-data interface, initially over cleartext HTTP and later HTTPS, to a hardcoded C2 IP address (179.43.166.242) allow-listed through an App Transport Security (ATS) exception baked into the payload's Info.plist. Operators manage compromised hosts through a web panel at hxxps://endpoint-api-v1[.]com/login.

Persistence is established via a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist (label com.apple.crashreporter.helper), configured with RunAtLoad=true and SuccessfulExit=false so the agent relaunches the stealer after any unsuccessful exit, ensuring the malware survives reboots and remains active across sessions; the malware also re-signs its own binary to keep its code signature valid after modification.

CrashStealer incorporates layered anti-analysis defenses typical of a maturing commercial-grade stealer: multiple sysctl-based debugger-detection checks (querying KERN_PROC / P_TRACED, exiting with code 45 if a debugger is attached), control-flow flattening using dispatch blocks and jump tables to hinder static analysis, and runtime string decryption for sensitive strings stored in the binary's __const section. Related attacker-controlled infrastructure identified alongside werkbit[.]io includes the domains cohezo[.]io, cohezo[.]com, and cordinex[.]io, suggesting a broader distribution network beyond the single observed campaign.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1543.001 Launch Agent
- T1547.015 Login Items
- T1036.005 Match Legitimate Resource Name or Location
- T1553.002 Code Signing
- T1218 System Binary Proxy Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1685 Disable or Modify Tools
- T1056.002 GUI Input Capture
- T1539 Steal Web Session Cookie
- T1555.001 Keychain
- T1555.005 Password Managers
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1573.001 Symmetric Cryptography
- T1657 Financial Theft
- T1583.001 Domains
- T1588.003 Code Signing Certificates

## Sources

- [This fake Apple app can unlock your Mac's password vault](https://www.malwarebytes.com/blog/threat-intel/2026/07/this-fake-apple-app-can-unlock-your-macs-password-vault)
- [New CrashStealer malware poses as Apple crash reporting tool](https://www.bleepingcomputer.com/news/security/new-crashstealer-malware-poses-as-apple-crash-reporting-tool/)
- [CrashStealer: C++ macOS Infostealer Posing as Crash Reporter](https://www.jamf.com/blog/crashstealer-macos-infostealer-analysis/)
- [CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks](https://thehackernews.com/2026/07/crashstealer-macos-malware-uses.html)
- ['CrashStealer' malware poses as an Apple tool to steal passwords & Mac data](https://appleinsider.com/articles/26/07/13/crashstealer-malware-poses-as-an-apple-tool-to-steal-passwords-mac-data)
- [New macOS malware steals passwords by posing as Apple's crash-reporting tool](https://www.helpnetsecurity.com/2026/07/14/crashstealer-macos-infostealer-password-theft/)
- [CrashStealer: New macOS Infostealer Uses Signed Apps to Evade Gatekeeper](https://securityaffairs.com/195278/malware/crashstealer-new-macos-infostealer-uses-signed-apps-to-evade-gatekeeper.html)
- [New macOS Malware Exploits Legitimate Developer ID to Pose as Apple Crash Reporter](https://www.infosecurity-magazine.com/news/macos-malware-apple-crash-reporter/)
- [This new macOS infostealer poses as an Apple crash reporting tool to try and steal all your valuable data](https://www.techradar.com/pro/security/this-new-macos-infostealer-poses-as-an-apple-crash-reporting-tool-to-try-and-steal-all-your-valuable-data)
- [New macOS Stealer Mimics Apple's Crash-Reporting Framework to Steal Browser Credentials](https://cybersecuritynews.com/macos-stealer-mimics-apples-crash-report/)
- [CrashStealer malware masquerades as Apple's crash report tool to raid your Mac](https://www.cultofmac.com/news/crashstealer-malware-fake-apple-crash-reporter)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1358