CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks ^⁠13%

7/13/2026, 10:36:00 AM

Topics: Malware, Information Stealers, Macos, Cybercrime

Keywords: Crashstealer, Macos, Malware, Notarized Dropper, Gatekeeper, Information Stealer, C, Jamf Threat Labs, Cybersecurity, Endpoint Security, Credential Theft, Cryptocurrency, Password Manager, Keychain

BS Summary: This article contains 15 faulty reasoning types, including Unattributed Quote, Framing Effect, and Anecdotal, with Ambiguity (Equivocation) as the most egregious example at 14.5% saturation with 74 hits. Analysis detected 483 faulty-reasoning hits from 510 analyzed words, generating a BS Score of 29.2% and a BS Rank of ⁠13% (19,225 of 21,887 articles). This article is better (less manipulative) than 87.80% of the article peer group.

Confidence50%

underlinesheatmap

510 words

Cybersecurity researchers have flagged a new macOS information stealer called CrashStealer that's capable of harvesting sensitive data from compromised systems.

Unlike other information stealers that are built on AppleScript droppers or Objective-C-based wrappers, CrashStealer is implemented in native C++, according to Jamf Threat Labs.

"It validates the victim's login password locally before harvesting, collects broadly across browsers, cryptocurrency wallets, password managers, and the keychain, encrypts what it collects with AES-GCM before exfiltrating over libcurl, and persists by copying and re-signing itself," security researcher Thijs Xhaflaire said in a report shared with The Hacker News.

CrashStealer is said to be distributed by means of a signed and Apple-notarized dropper that's distributed as a disk image file named "Werkbit.app."

Because both the disk image and binary are notarized and carry a valid developer ID ("Emil Grigorov (WWB7JA7AQV)"), it passes Gatekeeper checks.

The disk image itself originates from the domain "werkbit[.]io," which was registered in June 2026.

In an interesting twist, the download is gated behind a meeting PIN, meaning the installer is served only to those site visitors who arrive with the right code rather than everyone.

The discovery of additional domains and shared backend infrastructure tied to the same operation points to CrashStealer being part of a larger, multi-platform campaign.

Once mounted, the disk image presents the user with an installation setup screen that instructs them to right-click the app and choose "Open" to get them to run it.

Once launched, the "veltod" executable contacts a GitHub repository ("github.com/mgothiclove") to retrieve a file named "sys.cache."

The file is then used to extract a curl command and pull a shell script, which acts as a downloader to fetch and stage the next payload ("CrashReporter.dmg") and saves it to the "/tmp" directory.

The malware, upon execution, establishes persistence as a LaunchAgent, resists analysis, presents a password prompt and validates the entered credential locally, unlocks the login keychain using the validated password, lists installed security and analysis tooling, before proceeding to collect browser data, cryptocurrency wallet extensions, password manager data, and keychain material.

The complete list of data harvested is below -

Credentials from Chromium-family browsers, including Google Chrome, Brave, Microsoft Edge, Opera and Opera GX, Vivaldi, Chromium, and Naver Whale

Roughly 80 cryptocurrency wallet extensions, including MetaMask, Phantom, Coinbase, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, and Backpack

14 password managers, including 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass and RoboForm

File from ~/Documents and ~/Downloads directories

The harvested data is then packaged into a ZIP archive and exfiltrated to an attacker-controlled server ("179.43.166[.]

242").

"CrashStealer's delivery chain shows real care: rather than a bare, unsigned lure, the operators front the attack with a signed and notarized dropper that clears Gatekeeper before quietly fetching, re-signing and launching the payload," Jamf said.

"What sets it apart from the commodity stealer crowd is less what it collects than how it is built: client-side AES-GCM encryption of the collected files, and an emphasis on analysis resistance through control-flow flattening, encrypted strings and layered anti-debugging."

510 words analyzed.

Speakers

3speakers22%attributed speech400writer words

36 attributed words33% of attributed speech42% writer coverage

Attribution is sentence-level. Pattern percentages are calculated only from words assigned to that voice.

Loading…

Analysis

Hover over highlighted words in the article to view the associated bias or fallacy analysis.

CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks ^⁠13%

Speakers

Jamf

Analysis

Biases

Fallacies

Manipulations

CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks ⁠13%

Speakers

Jamf

Analysis

Biases

Fallacies

Manipulations

CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks ^⁠13%