# CrashStealer: Notarized macOS Malware Bypasses Apple's Gatekeeper to Steal Crypto, Passwords, and Keychain Data


A sophisticated new information stealer discovered by Jamf Threat Labs is exploiting Apple's own code-signing system to distribute malware that harvests sensitive credentials, cryptocurrency wallets, and encrypted keystroke data from macOS systems. Called CrashStealer, the malware is distributed through a signed and Apple-notarized dropper that bypasses Gatekeeper security checks—Apple's first line of defense against unsigned software—before quietly installing a payload engineered with advanced anti-analysis techniques.


The discovery underscores a growing trend: attackers are no longer relying on social engineering tricks alone to compromise Mac users. Instead, they're obtaining legitimate developer credentials, securing Apple's own notarization, and using those approvals as a trojan horse to deliver sophisticated credential-stealing malware.


## The Threat: A New Generation of macOS Malware


CrashStealer represents a departure from typical macOS information stealers, which often rely on AppleScript droppers or simpler Objective-C wrappers. This malware is built entirely in native C++, a language choice that gives attackers tighter control over system-level operations and makes reverse engineering significantly more difficult.


According to Jamf Threat Labs researcher Thijs Xhaflaire, CrashStealer is designed to harvest a broad range of sensitive data from infected systems, including:


  • Browser credentials and cached login data
  • Cryptocurrency wallet extensions and private keys
  • Passwords stored in popular password managers
  • macOS Keychain materials

    • The malware validates victim credentials locally before exfiltrating data, encrypts harvested information using AES-GCM encryption before transmission, and establishes persistence by copying and re-signing itself—ensuring it survives system reboots.


    ## The Delivery Chain: Subverting Apple's Security Controls


    What makes CrashStealer particularly concerning is not just its capabilities, but how it reaches victims in the first place. The attack begins with a digitally signed disk image file named "Werkbit.app," which is distributed from the domain werkbit[.]io (registered in June 2026).


    The disk image carries a valid Apple developer ID attributed to "Emil Grigorov (WWB7JA7AQV)" and has been properly notarized by Apple. This dual approval—developer ID signature plus notarization—allows the dropper to pass Gatekeeper without any warning prompts, making it virtually indistinguishable from legitimate software to end users.


    The infection flow operates in stages:


    1. Initial Download — The installer is gated behind a meeting PIN, suggesting the attackers are precisely targeting victims rather than deploying broadly

    2. Presentation — Once the disk image mounts, users see a standard installation screen prompting them to right-click the app and select "Open"

    3. Payload Retrieval — The initial "veltod" executable contacts a GitHub repository (github.com/mgothiclove) to retrieve a file called sys.cache

    4. Command Extraction — That file contains a curl command that fetches a shell script downloader

    5. Secondary Payload — The shell script retrieves a file called CrashReporter.dmg and stages it in /tmp

    6. Persistence — The main malware establishes persistence as a LaunchAgent, ensuring it survives reboots


    The use of GitHub as an intermediary—a legitimate platform that makes it difficult for security researchers to preemptively block payloads—represents a deliberate operational security choice by the attackers.


    ## Technical Capabilities: Comprehensive Data Theft


    Once executed, CrashStealer performs a systematic sweep of compromised systems. Before harvesting any data, the malware presents a password prompt and validates the entered credential locally against the system's login credentials. This unusual step—validating the password client-side before proceeding—suggests the attackers may be looking to confirm they have the correct victim or to ensure they can unlock additional encrypted data stores.


    After validation, the malware unlocks the user's login keychain using the validated password and begins its data collection routine.


    ### Data Harvesting Targets


    | Category | Coverage |

    |----------|----------|

    | Chromium-based Browsers | Google Chrome, Brave, Microsoft Edge, Opera, Opera GX, Vivaldi, Chromium, Naver Whale |

    | Cryptocurrency Wallets | ~80 extensions including MetaMask, Phantom, Coinbase, Trust Wallet, Rabby, OKX Wallet, Exodus, Keplr, Solflare, Backpack, and others |

    | Password Managers | 14 applications including 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, RoboForm |

    | System Keychain | All stored credentials and certificates |

    | File System | Documents and Downloads directories |


    The breadth of targeting suggests attackers are pursuing multiple revenue streams—selling cryptocurrency credentials to crypto thieves, financial credentials to fraudsters, and corporate credentials to business email compromise (BEC) operators.


    ## Anti-Analysis Defenses and Persistence


    CrashSteaker employs sophisticated techniques to resist detection and analysis:


  • Control-flow flattening — Obscures the logical structure of the code to frustrate manual reverse engineering
  • Encrypted strings — String literals are encrypted, preventing static analysis tools from identifying targeted applications or servers
  • Layered anti-debugging — Detects and resists debugger attachment, making dynamic analysis difficult
  • Analysis tool detection — Actively scans the infected system for installed security and analysis software
  • Local password validation — Prevents execution if the correct password isn't provided, potentially as an additional victim verification step

    • The harvested data is packaged into a ZIP archive and exfiltrated to an attacker-controlled server at 179.43.166[.]242. The use of AES-GCM encryption during transmission ensures the data cannot be intercepted by network monitoring tools.


    ## Campaign Scope: Indicators of a Larger Operation


    Jamf's investigation uncovered additional domains and shared backend infrastructure suggesting CrashStealer is part of a larger, multi-platform campaign. This discovery is significant—it indicates the attackers are building a modular malware ecosystem rather than launching a single, isolated attack.


    The development of macOS-specific variants alongside presumed Windows or Linux versions suggests a sophisticated threat actor with the capability to maintain multiple platform-specific codebases and infrastructure.


    ## Implications for macOS Users and Organizations


    The CrashStealer campaign exposes a critical vulnerability in Apple's security model: notarization and code signing, while raising the bar for malware distribution, are not impenetrable.


    Key implications:


  • Compromised Developer IDs — Attackers have obtained or are using legitimate Apple developer credentials, demonstrating that the identity verification process for developer accounts may be insufficient
  • False Sense of Security — The presence of an Apple notarization may make users trust software they would otherwise scrutinize
  • Targeted Attacks — The PIN-gated distribution suggests attackers are conducting targeted phishing campaigns to deliver the malware to specific victims or victim categories
  • Cryptocurrency Targets — The focus on wallet extensions indicates attackers are particularly interested in cryptocurrency theft, which may be more profitable and less traceable than traditional financial fraud

    • ## Recommendations for Defense


    For Individual Mac Users:

  • Be skeptical of software that requires running unfamiliar installer commands (right-click to open)
  • Enable FileVault full-disk encryption to protect data at rest
  • Use unique, strong passwords for critical accounts; enable two-factor authentication on cryptocurrency exchanges and password managers
  • Monitor Activity Monitor for unexpected processes; suspicious "CrashReporter" processes should be investigated
  • Keep macOS and all browser extensions updated

    • For Organizations:

  • Implement Mobile Device Management (MDM) solutions that can enforce security policies and restrict unsigned software
  • Monitor for unsigned or newly signed developer IDs in application deployments
  • Conduct regular audits of browser extensions, particularly cryptocurrency and financial management tools
  • Enable robust logging of LaunchAgent creation and modification
  • Consider blocking or restricting GitHub access if attackers are known to use it for payload hosting
  • Educate users that Apple notarization is a technical control, not a guarantee of safety

    • ---


    ## HackWire Analysis


    CrashStealer demonstrates that macOS is no longer immune to sophisticated malware campaigns. For years, the narrative has been that macOS is inherently more secure than Windows due to its smaller target surface and tight integration with hardware. But this incident reveals a harder truth: Apple's security controls are a speed bump, not a wall.


    The discovery that attackers have obtained legitimate Apple developer credentials—or found ways to exploit the notarization process—is particularly alarming because it means Apple itself is now part of the supply chain attack surface. Every macOS user who has ever seen the "notarized and code-signed" indicator in a security prompt is trained to trust that marker. CrashStealer weaponizes that trust.


    What's most significant is the operational maturity on display. The attackers didn't just obtain a developer ID; they obtained it under a legitimate-sounding name ("Emil Grigorov"), they registered corresponding domains, they built a multi-stage delivery chain with staged payloads, and they gated distribution behind PINs to ensure victims arrived pre-targeted. This isn't script-kiddie malware—this is professional, revenue-focused cybercrime infrastructure.


    The cryptocurrency wallet targeting is also worth noting. The malware doesn't just steal credentials; it specifically targets roughly 80 different wallet extensions. This precision indicates the attackers have a ready market for cryptocurrency credentials—whether that's direct wallet draining, credential reuse attacks, or sale to other actors. In the era of decentralized finance, stealing crypto credentials is often more valuable and more easily monetized than traditional banking credentials.


    For defenders, the lesson is stark: assume Gatekeeper approval is not a security guarantee. Monitor for suspicious LaunchAgents, be suspicious of software requiring unusual installation procedures, and implement endpoint detection and response (EDR) solutions that can detect multi-stage payload delivery chains even when individual stages are signed.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Breaches](https://www.hackwire.news/category/breaches)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)