CrashStealer macOS Malware Bypasses Gatekeeper via Notarized Dropper

Cybersecurity researchers at Jamf Threat Labs have identified a sophisticated new macOS information stealer dubbed CrashStealer, distinguished by its native C++ implementation rather than the AppleScript droppers or Objective-C wrappers commonly seen in competing stealers. Distributed through a disk image file named "Werkbit.app" hosted on the domain werkbit[.]io (registered June 2026), the dropper is both signed and Apple-notarized under the developer ID "Emil Grigorov (WWB7JA7AQV)," allowing it to pass Gatekeeper security checks without raising user suspicion. The campaign appears gated behind a meeting PIN, meaning the installer is only served to visitors who arrive with the correct referral code, suggesting a targeted distribution model. Shared backend infrastructure linking multiple domains indicates CrashStealer is part of a larger multi-platform operation.

Upon execution, the "veltod" binary reaches out to a GitHub repository (github.com/mgothiclove) to download a staging file named "sys.cache," which is decoded to extract a curl command that pulls a shell-script downloader responsible for fetching the next-stage payload, "CrashReporter.dmg," into the /tmp directory. The malware then installs itself as a LaunchAgent for persistence, presents a fake password prompt, and validates the entered credentials locally. Once armed with the victim's login password, CrashStealer unlocks the macOS login keychain and enumerates installed security and analysis tools to resist forensic examination before beginning its data collection phase. Anyone concerned about credential exposure can run a quick email breach checker to see whether their accounts have already appeared in known dumps.

CrashStealer's harvesting scope is extensive: it targets credentials stored in Chromium-family browsers (Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, and Naver Whale), roughly 80 cryptocurrency wallet extensions (including MetaMask, Phantom, Coinbase, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, and Backpack), 14 password managers (1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm), sensitive files in ~/Documents and ~/Downloads, and Keychain material. All collected data is compressed into a ZIP archive and encrypted with AES-GCM before being exfiltrated over libcurl to an attacker-controlled server. With stolen credentials from password managers and keychains in play, users should verify the strength of reused passwords using a password checker and rotate any secrets that may have been stored on an infected system.