# CrashStealer: Novel macOS Information Stealer Disguised as Apple Crash Reporter (Jamf Threat Labs)

> Jamf Threat Labs disclosed CrashStealer, a native C++ macOS infostealer distributed via a signed and Apple-notarized "Werkbit Setup" dropper that fetches and installs a payload impersonating Apple's CrashReporter component. It harvests browser, cryptocurrency wallet, password-manager, and Keychain credentials, spoofs native macOS password prompts, encrypts stolen data with AES-256-GCM, exfiltrates over libcurl to a hardcoded C2 IP, and uses control-flow flattening, encrypted strings, and anti-debugging to resist analysis.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1470
- **ID:** TL-2026-1470
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CrashStealer is a macOS information stealer, first observed under development on VirusTotal in May 2026 and seen in active in-the-wild deployment by early July 2026, publicly disclosed by Jamf Threat Labs on July 13, 2026. Unlike most commodity macOS stealer activity (which is typically written in scripting languages or Swift), CrashStealer is implemented natively in C++ around an internal orchestration class the authors named MacOSData, exposing collection routines such as collectBrowserData, collectExtensions, collectFirefoxExtensions, collectSoftwareTargets, and runFileSearcher.

The infection chain begins with a signed and Apple-notarized disk image named "Werkbit Setup" containing Werkbit.app, whose executable (internal name veltod, bundle identifier dev.golove.velto) is signed with Developer ID "Emil Grigorov (WWB7JA7AQV)" and hardened runtime enabled -- allowing it to clear Gatekeeper without warning. Distribution occurred via the fake software site werkbit[.]io, registered in late June 2026, with downloads gated behind a meeting PIN to limit exposure to targeted visitors.

On execution, veltod queries the GitHub API to retrieve sys.cache from the repository mgothiclove/pkeys, which directs it to fetch a Base64-encoded shell script from endpoint-api-v1[.]com/d/f1b24e. That script downloads CrashReporter.dmg over cleartext HTTP from endpoint-api-v1[.]com/d/f1b24e/download, mounts it, and copies the CrashReporter.app bundle (bundle ID com.apple.crashreporter, impersonating a genuine Apple component) into the hidden staging directory /tmp/.CrashReporter/, stripping the original signature and re-signing ad-hoc before launch and disk-image cleanup. The payload persists by copying itself to ~/Library/Caches/com.apple.crashreporter/CrashReporter.app and installing a LaunchAgent at ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist (label com.apple.crashreporter.helper) with RunAtLoad true and KeepAlive/SuccessfulExit false, causing automatic relaunch; each re-signing operation changes the binary's hash while preserving code.

Before harvesting, CrashStealer displays a native-styled fake macOS password-authorization prompt to the user and validates the entered credential locally via dscl -authonly (a legitimate macOS directory-service utility), caching the validated password to ~/.cache/.sys_auth (mode 600) for reuse. It then runs collectSoftwareTargets, a reconnaissance pass against embedded security/EDR/analysis tool names using defaults read and du -sh. Data collection targets Chromium-family browsers (Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, NAVER Whale) and Firefox login data, approximately 80 cryptocurrency wallet browser extensions (including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, Backpack), and 14 password managers (1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, RoboForm, among others), plus a copy of the local login.keychain-db. A separate file-searcher routine recursively walks ~/Documents and ~/Downloads, excluding cache/log paths and filtering out large binaries/installers.

Collected files are individually encrypted with AES-256-GCM (Apple CommonCrypto), keyed via PBKDF2-HMAC-SHA256 over 10,000 iterations with a hardcoded salt constant panel_salt_v1, staged as .cache files, then packaged into hidden ZIP archives named with a .zx_ prefix plus 8 random hex characters (e.g. .zx_c67e4203.zip) inside ~/.cache/com.apple.crashreporter/. Exfiltration uses libcurl's multipart (curl_mime) interface to a hardcoded C2 IP, 179.43.166.242, embedded in Info.plist as an App Transport Security exception; earlier samples' ATS configuration permitted cleartext HTTP, dropped the minimum TLS version to 1.0, and waived forward secrecy for that IP.

The malware employs analysis-resistance techniques atypical for commodity macOS stealers: control-flow flattening (dispatch-block/jump-table branching), encrypted strings held as a blob in the __const section and decoded at runtime via a byte-substitution routine, and a pre-main constructor (run during dynamic-linker initialization) that queries sysctl KERN_PROC/P_TRACED to detect an attached debugger and exits with code 45 if found, plus an additional later-stage debugger check.

Jamf attributed operator infrastructure including delivery domain endpoint-api-v1[.]com and werkbit[.]io, and operator/panel domains cohezo[.]io, cohezo[.]com, and cordinex[.]io. Following Jamf's disclosure and notification, Apple revoked the Developer ID (Emil Grigorov, WWB7JA7AQV) used to sign the Werkbit dropper, disabling the specific delivery vector documented, though Jamf and other outlets caution the malware or a re-signed variant could resurface under a new identity.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1059 Command and Scripting Interpreter
- T1543.001 Launch Agent
- T1647 Plist File Modification
- T1036.005 Match Legitimate Resource Name or Location
- T1553.002 Code Signing
- T1564.001 Hidden Files and Directories
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1112 Modify Registry
- T1685 Disable or Modify Tools
- T1497.001 System Checks
- T1056.002 GUI Input Capture
- T1555 Credentials from Password Stores
- T1555.001 Keychain
- T1555.005 Password Managers
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1518.001 Security Software Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1074.001 Local Data Staging
- T1071.001 Web Protocols
- T1102 Web Service
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration
- T1583.001 Domains
- T1585.003 Cloud Accounts

## Sources

- [In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint](https://www.securityweek.com/in-other-news-iran-tracks-us-military-phones-crashstealer-macos-malware-cvd-blueprint/)
- [CrashStealer: C++ macOS Infostealer Posing as Crash Reporter](https://www.jamf.com/blog/crashstealer-macos-infostealer-analysis/)
- [CrashStealer Malware Impersonates Apple Tool to Steal Mac Passwords and Crypto](https://www.macrumors.com/2026/07/15/crashstealer-mac-malware/)
- [New macOS malware steals passwords by posing as Apple's crash-reporting tool](https://www.helpnetsecurity.com/2026/07/14/crashstealer-macos-infostealer-password-theft/)
- [Jamf Threat Labs releases analysis of macOS info stealer dubbed 'CrashStealer'](https://www.mactech.com/2026/07/13/jamf-threat-labs-releases-analysis-of-macos-info-stealer-dubbed-crashstealer/amp/)
- [New CrashStealer malware poses as Apple crash reporting tool](https://www.bleepingcomputer.com/news/security/new-crashstealer-malware-poses-as-apple-crash-reporting-tool/)
- [New MacOS Malware Exploits Legitimate Developer ID to Pose as Apple Crash Reporter](https://www.infosecurity-magazine.com/news/macos-malware-apple-crash-reporter/)
- [This new macOS infostealer poses as an Apple crash reporting tool to try and steal all your valuable data](https://www.techradar.com/pro/security/this-new-macos-infostealer-poses-as-an-apple-crash-reporting-tool-to-try-and-steal-all-your-valuable-data)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1470