Jamf Threat Labs has identified a new macOS information stealer called CrashStealer that bypasses Apple’s Gatekeeper protections using a signed and notarized dropper. The malware, which impersonates Apple’s crash reporting framework, has moved from development into active in-the-wild attacks since early July 2026.
Unlike typical macOS stealers that rely on AppleScript or Objective-C wrappers, CrashStealer is written in native C++ around an internal class named MacOSData. It validates the victim’s login password locally before harvesting credentials, then collects broadly across Chromium-based browsers, roughly 80 cryptocurrency wallet extensions including MetaMask and Phantom, 14 password managers including 1Password and Bitwarden, and files from key system directories including the keychain.
The initial access vector is a disk image named “Werkbit Setup,” which contains a signed and Apple-notarized application bundle. Because the dropper carries a valid Apple Developer ID (Emil Grigorov, WWB7JA7AQV) and a stapled notarization ticket, it clears Gatekeeper on first launch without triggering warnings. The disk image itself is also signed, a rarity in malicious DMG delivery where containers are typically left unsigned.
Once launched, the dropper fetches a payload from attacker infrastructure using a multi-stage delivery chain that begins with a request to GitHub, then retrieves a shell script from endpoint-api-v1[.]com. The script downloads the actual CrashStealer payload — a disk image impersonating Apple’s CrashReporter with bundle identifier com.apple.crashreporter — strips its signature and re-signs it ad-hoc before launching it from a hidden directory at /tmp/.CrashReporter.
CrashStealer establishes persistence as a LaunchAgent and encrypts exfiltrated data using AES-GCM before transmitting it over libcurl. It employs control-flow flattening and encrypted strings to resist analysis. Jamf has identified additional domains and shared backend infrastructure suggesting CrashStealer is part of a larger, multi-platform campaign. The Jamf team reported the malicious Developer Team ID to Apple for action.
