CrashStealer: The macOS Malware That Fooled Apple Itself

CrashStealer, a native C++ macOS infostealer, was distributed via a dropper signed and notarized by Apple, bypassing Gatekeeper checks without any user warning.

{"main_topic":"malware","topics":["malware","infostealer","macos","cybersec","apple"]}

CrashStealer, a native C++ macOS infostealer, was distributed via a dropper signed and notarized by Apple, bypassing Gatekeeper checks without any user warning. Analysis by Jamf Threat Labs, published July 13, 2026, documents a campaign that began at least in May and was detected on enterprise endpoints in early July. The case demonstrates that an Apple digital signature and notarization do not guarantee software safety.

Key Takeaways

The Werkbit.app dropper, with Developer ID "Emil Grigorov (WWB7JA7AQV)", was signed and notarized by Apple: Gatekeeper allowed it to pass without warning.
CrashStealer impersonates the Apple CrashReporter utility, validates the local password via the legitimate dscl command, then unlocks the keychain and steals data from roughly 80 crypto wallets and 14 password managers.
Collected data is encrypted with AES-256-GCM and exfiltrated to the C2 server 179.43.166[.]242 via libcurl.
The campaign is cross-platform: lookalike domains for meeting and collaboration apps point to a shared backend, with installers also for Windows.

How the Multi-Stage Delivery Chain Works

The malware does not arrive directly. The user downloads a disk image from the domain werkbit[.]io, registered in June 2026, protected by a meeting PIN. The binary inside, Werkbit.app, contacts the GitHub repository mgothiclove/pkeys to retrieve a hidden instruction file named sys.cache. From there the next stage activates: download of the actual payload, which is copied, re-signed with an ad-hoc signature to mutate its hash, and then launched.

The payload assumes the identity of CrashReporter.app, with bundle identifier com.apple.crashreporter and an icon mimicking Apple's style. This choice is not cosmetic: a user who sees a process with a familiar name and icon is less likely to intervene. The malware then requests the system password, ostensibly for a security check, but actually to unlock the login keychain and access the credentials database.

The Technical Core: Native C++ and Advanced Anti-Analysis

According to Jamf Threat Labs, CrashStealer stands apart from typical commodity stealers in the macOS landscape, which are usually built on AppleScript or Objective-C. The native C++ implementation indicates above-average development rigor, with analysis-resistance techniques that include control-flow flattening, encrypted strings, and multiple checks to detect debuggers. These measures make both static and dynamic analysis more difficult for researchers.

Data collection is extensive and targeted: roughly 80 cryptocurrency wallet extensions, including MetaMask, Phantom, Coinbase, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, and Backpack; 14 password managers, including 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm; credentials and cookies from Chromium-family browsers; files from the Documents and Downloads folders. Data is encrypted with AES-256-GCM before exfiltration, complicating interception in transit.

Persistence and the Mutating Signature

CrashStealer installs itself as a LaunchAgent in ~/Library/LaunchAgents/com.apple.crashreporter.helper.plist, with a configuration that forces a restart after an unsuccessful exit. To evade hash-based checks, the malware removes the file's extended attributes and applies a new ad-hoc signature, altering its digital fingerprint upon every reinstallation. This re-signing technique is particularly effective against detection solutions that rely solely on certificate reputation.

"CrashStealer's delivery chain shows real care: rather than a bare, unsigned lure, the operators front the attack with a signed and notarized dropper that clears Gatekeeper before quietly fetching, re-signing and launching the payload" — Jamf Threat Labs

The delivery mechanism, as documented by the sources, shows deliberate attention to the quality of the attack's front-end: Apple notarization functions as a visual shield for the user and a technical bypass for the operating system.

The Cross-Platform Campaign and Shared Backend

Analysis identified a network of lookalike domains impersonating enterprise meeting and collaboration applications: Cohezo, Cordinex, Synerix, Collabox, Werknova. These domains share a common backend at icky-lyrical[.]com. Alongside the macOS version, researchers found a Windows installer, confirming the campaign is not confined to the Apple ecosystem. Targeting appears oriented toward the professional world, with meeting PINs used as a gatekeeping mechanism to filter victims.

The command panel hosted at endpoint-api-v1[.]com was detected, but its full scope is not documented in available sources. No infrastructure overlaps link the operators to a known threat actor at this time.

What to Do Now

Apple revoked the signing credentials associated with the malicious application after Jamf's report. For users and system administrators, priority actions derive directly from the technical dossier:

Check for the presence of the LaunchAgent com.apple.crashreporter.helper.plist in ~/Library/LaunchAgents: a file with that name that does not correspond to the official system path is an indicator of compromise.
Check for connections to IP 179.43.166[.]242 or domain endpoint-api-v1[.]com in network logs: the source documents these as indicators of active exfiltration in the analyzed builds.
Inspect cloned repositories or files downloaded from GitHub under the username mgothiclove, particularly the pkeys repository and the sys.cache file, as confirmed by the documented delivery chain.
Monitor for processes named CrashReporter.app that do not reside in /System/Library/CoreServices or official Apple paths, given the stolen identity documented by the malware.

The dossier does not specify additional remediation measures or vendor hardening recommendations. The exact nature of exposed data beyond the listed categories remains undetailed in the sources.

Why Apple Notarization Is No Longer Enough

The CrashStealer case raises a structural question for macOS security. Gatekeeper is designed to block software from unidentified developers; notarization adds an automated Apple check on the binary. But both mechanisms trust the certificate as a proxy for reliability, not the software's behavior. An actor who obtains a valid Developer ID — through purchase, compromise, or social engineering — inherits that trust until revocation, which happens reactively, not preventively.

According to Jamf Threat Labs, as cited by AppleInsider, "Werkbit carried a valid Developer ID associated with Emil Grigorov and passed Gatekeeper without an unidentified-developer warning." The same source adds: "The Werkbit delivery chain also shows that a valid signature, Apple notarization and a clean Gatekeeper check aren't guarantees that software is safe." The gap between this finding and the typical Mac user experience — which associates the Apple dialog with software goodness — measures the residual risk.

The cross-platform campaign, with its shared backend and PIN-filtered distribution, further indicates that operators invest in durable infrastructure, not opportunistic, disposable attacks. The fact that Jamf found the first sample on VirusTotal in early May and the first customer detections in early July suggests an incubation or testing period before widespread distribution.

The malware targets a specific victim profile: those who hold assets in cryptocurrency wallets and manage credentials through password managers, typically a tech-savvy user who may lower their guard against a binary "approved" by Apple. The lesson is that the certificate validates origin, not intent.

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references