CrashStealer is a macOS information stealer, first observed under development on VirusTotal in May 2026 and seen in active in-the-wild deployment by early July 2026, publicly disclosed by Jamf Threat Labs on July 13, 2026. Unlike most commodity macOS stealer activity (which is typically written in scripting languages or Swift), CrashStealer is implemented natively in C++ around an internal orchestration class the authors named MacOSData, exposing collection routines such as collectBrowserData, collectExtensions, collectFirefoxExtensions, collectSoftwareTargets, and runFileSearcher.

The infection chain begins with a signed and Apple-notarized disk image named "Werkbit Setup" containing Werkbit.app, whose executable (internal name veltod, bundle identifier dev.golove.velto) is signed with Developer ID "Emil Grigorov (WWB7JA7AQV)" and hardened runtime enabled -- allowing it to clear Gatekeeper without warning. Distribution occurred via the fake software site werkbit[.]io, registered in late June 2026, with downloads gated behind a meeting PIN to limit exposure to targeted visitors.

On execution, veltod queries the GitHub API to retrieve sys.cache from the repository mgothiclove/pkeys, which directs it to fetch a Base64-encoded shell script from endpoint-api-v1[.]com/d/f1b24e. That script downloads CrashReporter.dmg over cleartext HTTP from endpoint-api-v1[.]com/d/f1b24e/download, mounts it, and copies the CrashReporter.app bundle (bundle ID com.apple.crashreporter, impersonating a genuine Apple component) into the hidden staging directory /tmp/.CrashReporter/, stripping the original signature and re-signing ad-hoc before launch and disk-image cleanup. The payload persists by copying itself to ~/Library/Caches/com.apple.crashreporter/CrashReporter.app and installing a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist (label com.apple.crashreporter.helper) with RunAtLoad true and KeepAlive/SuccessfulExit false, causing automatic relaunch; each re-signing operation changes the binary's hash while preserving code.

Before harvesting, CrashStealer displays a native-styled fake macOS password-authorization prompt to the user and validates the entered credential locally via dscl -authonly (a legitimate macOS directory-service utility), caching the validated password to ~/.cache/.sys_auth (mode 600) for reuse. It then runs collectSoftwareTargets, a reconnaissance pass against embedded security/EDR/analysis tool names using defaults read and du -sh. Data collection targets Chromium-family browsers (Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, NAVER Whale) and Firefox login data, approximately 80 cryptocurrency wallet browser extensions (including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, Backpack), and 14 password managers (1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, RoboForm, among others), plus a copy of the local login.keychain-db. A separate file-searcher routine recursively walks ~/Documents and ~/Downloads, excluding cache/log paths and filtering out large binaries/installers.

Collected files are individually encrypted with AES-256-GCM (Apple CommonCrypto), keyed via PBKDF2-HMAC-SHA256 over 10,000 iterations with a hardcoded salt constant panel_salt_v1, staged as .cache files, then packaged into hidden ZIP archives named with a .zx_ prefix plus 8 random hex characters (e.g. .zx_c67e4203.zip) inside ~/.cache/com.apple.crashreporter/. Exfiltration uses libcurl's multipart (curl_mime) interface to a hardcoded C2 IP, 179.43.166.242, embedded in Info.plist as an App Transport Security exception; earlier samples' ATS configuration permitted cleartext HTTP, dropped the minimum TLS version to 1.0, and waived forward secrecy for that IP.

The malware employs analysis-resistance techniques atypical for commodity macOS stealers: control-flow flattening (dispatch-block/jump-table branching), encrypted strings held as a blob in the __const section and decoded at runtime via a byte-substitution routine, and a pre-main constructor (run during dynamic-linker initialization) that queries sysctl KERN_PROC/P_TRACED to detect an attached debugger and exits with code 45 if found, plus an additional later-stage debugger check.

Jamf attributed operator infrastructure including delivery domain endpoint-api-v1[.]com and werkbit[.]io, and operator/panel domains cohezo[.]io, cohezo[.]com, and cordinex[.]io. Following Jamf's disclosure and notification, Apple revoked the Developer ID (Emil Grigorov, WWB7JA7AQV) used to sign the Werkbit dropper, disabling the specific delivery vector documented, though Jamf and other outlets caution the malware or a re-signed variant could resurface under a new identity.