CrashStealer: Novel macOS Information Stealer Disguised as Apple Crash Reporter (Jamf Threat Labs) — Threadlinqs Intelligence
As of 2026-07-18, CrashStealer: Novel macOS Information Stealer Disguised as Apple Crash Reporter (Jamf Threat Labs) is a medium-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-1470 · Severity: MEDIUM · Status: ACTIVE · Category: MALWARE
Jamf Threat Labs disclosed CrashStealer, a native C++ macOS infostealer distributed via a signed and Apple-notarized "Werkbit Setup" dropper that fetches and installs a payload impersonating Apple's
CrashStealer is a macOS information stealer, first observed under development on VirusTotal in May 2026 and seen in active in-the-wild deployment by early July 2026, publicly disclosed by Jamf Threat Labs on July 13, 2026. Unlike most commodity macOS stealer activity (which is typically written in scripting languages or Swift), CrashStealer is implemented natively in C++ around an internal orchestration class the authors named MacOSData, exposing collection routines such as collectBrowserData, collectExtensions, collectFirefoxExtensions, collectSoftwareTargets, and runFileSearcher.
The infection chain begins with a signed and Apple-notarized disk image named "Werkbit Setup" containing Werkbit.app, whose executable (internal name veltod, bundle identifier dev.golove.velto) is signed with Developer ID "Emil Grigorov (WWB7JA7AQV)" and hardened runtime enabled -- allowing it to clear Gatekeeper without warning. Distribution occurred via the fake software site werkbit[.]io, registered in late June 2026, with downloads gated behind a meeting PIN to limit exposure to targeted visitors.
On execution, veltod queries the GitHub API to retrieve sys.cache from the repository mgothiclove/pkeys, which directs it to fetch a Base64-encoded shell script from endpoint-api-v1[.]com/d/f1b24e. That script downloads CrashReporter.dmg over cleartext HTTP from endpoint-api-v1[.]com/d/f1b24e/download, mounts it, and copies the CrashReporter.app bundle (bundle ID com.apple.crashreporter, impersonating a genuine Apple component) into the hidden staging directory /tmp/.CrashReporter/, stripping the original signature and re-signing ad-hoc before launch and disk-image cleanup. The payload persists by copying itself to ~/Library/Caches/com.apple.crashreporter/CrashReporter.app and installing a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist (label com.apple.crashreporter.helper) with RunAtLoad true and KeepAlive/SuccessfulExit false, causing automatic relaunch; each re-signing operation changes the binary's hash while preserving code.
Before harvesting, CrashStealer displays a native-styled fake macOS password-authorization prompt to the user and validates the entered credential locally via dscl -authonly (a legitimate macOS directory-service utility), caching the validated password to ~/.cache/.sys_auth (mode 600) for reuse. It then runs collectSoftwareTargets, a reconnaissance pass against embedded security/EDR/analysis tool names using defaults read and du -sh. Data collection targets Chromium-family browsers (Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, NAVER Whale) and Firefox login data, approximately 80 cryptocurrency wallet browser extensions (including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, Backpack), and 14 password managers (1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, RoboForm, among others), plus a copy of the local login.keychain-db. A separate file-searcher routine recursively walks ~/Documents and ~/Downloads, excluding cache/log paths and filtering out large binaries/installers.
Collected files are individually encrypted with AES-256-GCM (Apple CommonCrypto), keyed via PBKDF2-HMAC-SHA256 over 10,000 iterations with a hardcoded salt constant panel_salt_v1, staged as .cache files, then packaged into hidden ZIP archives named with a .zx_ prefix plus 8 random hex characters (e.g. .zx_c67e4203.zip) inside ~/.cache/com.apple.crashreporter/. Exfiltration uses libcurl's multipart (curl_mime) interface to a hardcoded C2 IP, 179.43.166.242, embedded in Info.plist as an App Transport Security exception; earlier samples' ATS configuration permitted cleartext HTTP, dropped the minimum TLS version to 1.0, and waived forward secrecy for that IP.
The malware employs analysis-resistance techniques atypical for commodity macOS stealers: control-flow flattening (dispatch-block/jump-table branching), encrypted strings held as a
Weaknesses (CWE)
CWE-451, CWE-506, CWE-522, CWE-311
Target sectors: technology, finance, generalconsumer, cryptocurrency
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, MEDIUM, threat intelligence, cybersecurity, T1566, T1189, T1204.002, T1059, T1543.001, T1547.011, T1036.005, T1553.002, T1564.001, T1027