> ## Content Index
> Fetch the complete content index at: https://www.russianhackers.co/llms.txt
> Use this file to discover other available public pages before exploring further.

# CrashStealer: macOS Malware Passed Apple's Checks and Posed as a System App
- URL: https://www.russianhackers.co/crashstealer-macos-notarized-infostealer/
- Published: 2026-07-14T15:19:30.000Z
- Updated: 2026-07-15T16:31:22.000Z
- Description: A macOS infostealer disguises itself as Apple's own CrashReporter and lands on Macs with a valid, notarized developer signature that Gatekeeper waves through without a warning.
- Author: Martin
- Tags: Malware, Hackers

Researchers at Jamf Threat Labs have detailed a new macOS infostealer called CrashStealer. Its defining trick is that it does not break Apple's protections, it borrows them: the first stage of the infection carries a valid Developer ID and a notarization ticket, so Gatekeeper lets it run silently, with none of the usual "app from an unidentified developer" warnings.

## How the victim gets it

CrashStealer is delivered by hand, not sprayed at random. The file sits on a site called werkbit\[.\]io, dressed up as the installer for a meeting app named Werkbit, and it can only be downloaded after entering a meeting PIN. That gating means the link is sent to specific, hand-picked targets. The installer looks convincing and instructs the victim to open it with a right-click, a move that helps sidestep some of the system's warnings.

## The infection chain

The first executable, named `veltod`, is signed with a genuine Developer ID under the name Emil Grigorov and built as a universal binary for both Apple Silicon and Intel. That legitimate signature and stapled notarization are exactly what carry it past Gatekeeper.

From there it runs a multi-stage download hidden behind legitimate services:

1. The dropper calls the GitHub API and pulls a file named `sys.cache` from the repository `mgothiclove/pkeys`.
2. Inside is a Base64-encoded curl command.
3. It downloads a shell script from the attackers' server.
4. The script fetches `CrashReporter.dmg` over plain HTTP, mounts it, and unpacks the payload.
5. The payload is re-signed locally and launched from a hidden folder under `/private/tmp/`.

The final app passes itself off as an Apple system component: it uses the bundle identifier `com.apple.crashreporter`, so on the machine it looks like the built-in crash reporter.

## What it steals

Once it is in, CrashStealer behaves like a full-blown stealer and casts a wide net:

- **Browsers:** Chrome, Brave, Edge, Opera, Vivaldi, Chromium and NAVER Whale, taking passwords, cookies and sessions.
- **Crypto wallets:** around 80 extensions, including MetaMask, Phantom, Coinbase, Trust Wallet and OKX, covering Solana, Cosmos, TON, Sui, Aptos and NEO.
- **Password managers:** 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass and RoboForm.
- **System:** the malware first validates the user's password through `dscl -authonly`, then unlocks the login keychain and copies it for itself.
- **Files:** a recursive sweep of Documents, Downloads, Desktop and external drives, while deliberately skipping caches, system files and large media.

## Stealth and persistence

CrashStealer encrypts what it steals on the device, as it collects, using AES-256-GCM: each file becomes a separate `.cache` so nothing sits in the open on disk. It then packs everything into hidden ZIP archives and sends them to a command server at the IP address 179.43.166.242.

To survive a reboot, the malware copies itself into `~/Library/Caches/` as `CrashReporter.app` and installs a LaunchAgent set to relaunch after every exit. It also ships with anti-analysis defenses: flattened control flow, encrypted strings and debugger checks that shut the program down the moment it senses one.

## Who is behind it

The werkbit\[.\]io domain was registered in late June 2026, almost the same time the dropper was built. The infrastructure, a GitHub repository, a backend at endpoint-api-v1\[.\]com and operator panels on cohezo\[.\]io, cohezo\[.\]com and cordinex\[.\]io, points to a standing operation rather than a throwaway one. Jamf reported the exposed Developer ID to Apple after confirming it was being used to distribute the malware.

*Based on research by Jamf Threat Labs.*