CrashStealer: macOS Malware Passed Apple's Checks and Posed as a System App

Researchers at Jamf Threat Labs have detailed a new macOS infostealer called CrashStealer. Its defining trick is that it does not break Apple's protections, it borrows them: the first stage of the infection carries a valid Developer ID and a notarization ticket, so Gatekeeper lets it run silently, with none of the usual "app from an unidentified developer" warnings.

How the victim gets it

CrashStealer is delivered by hand, not sprayed at random. The file sits on a site called werkbit[.]io, dressed up as the installer for a meeting app named Werkbit, and it can only be downloaded after entering a meeting PIN. That gating means the link is sent to specific, hand-picked targets. The installer looks convincing and instructs the victim to open it with a right-click, a move that helps sidestep some of the system's warnings.

The infection chain

The first executable, named veltod, is signed with a genuine Developer ID under the name Emil Grigorov and built as a universal binary for both Apple Silicon and Intel. That legitimate signature and stapled notarization are exactly what carry it past Gatekeeper.

From there it runs a multi-stage download hidden behind legitimate services:

1. The dropper calls the GitHub API and pulls a file named sys.cache from the repository mgothiclove/pkeys.
2. Inside is a Base64-encoded curl command.
3. It downloads a shell script from the attackers' server.
4. The script fetches CrashReporter.dmg over plain HTTP, mounts it, and unpacks the payload.
5. The payload is re-signed locally and launched from a hidden folder under /private/tmp/.

The final app passes itself off as an Apple system component: it uses the bundle identifier com.apple.crashreporter, so on the machine it looks like the built-in crash reporter.

What it steals

Once it is in, CrashStealer behaves like a full-blown stealer and casts a wide net:

• Browsers: Chrome, Brave, Edge, Opera, Vivaldi, Chromium and NAVER Whale, taking passwords, cookies and sessions.
• Crypto wallets: around 80 extensions, including MetaMask, Phantom, Coinbase, Trust Wallet and OKX, covering Solana, Cosmos, TON, Sui, Aptos and NEO.
• Password managers: 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass and RoboForm.
• System: the malware first validates the user's password through dscl -authonly, then unlocks the login keychain and copies it for itself.
• Files: a recursive sweep of Documents, Downloads, Desktop and external drives, while deliberately skipping caches, system files and large media.

Stealth and persistence

CrashStealer encrypts what it steals on the device, as it collects, using AES-256-GCM: each file becomes a separate .cache so nothing sits in the open on disk. It then packs everything into hidden ZIP archives and sends them to a command server at the IP address 179.43.166.242.

To survive a reboot, the malware copies itself into ~/Library/Caches/ as CrashReporter.app and installs a LaunchAgent set to relaunch after every exit. It also ships with anti-analysis defenses: flattened control flow, encrypted strings and debugger checks that shut the program down the moment it senses one.

Who is behind it

The werkbit[.]io domain was registered in late June 2026, almost the same time the dropper was built. The infrastructure, a GitHub repository, a backend at endpoint-api-v1[.]com and operator panels on cohezo[.]io, cohezo[.]com and cordinex[.]io, points to a standing operation rather than a throwaway one. Jamf reported the exposed Developer ID to Apple after confirming it was being used to distribute the malware.

Based on research by Jamf Threat Labs.