Crash Stealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks
Summary: Jamf Threat Labs reported a new macOS information stealer called CrashStealer, written in native C++, that validates the victim's login password locally, harvests browser, cryptocurrency wallet, password manager and keychain data, encrypts it with AES-GCM and exfiltrates it over libcurl. It is distributed through a signed and Apple-notarized disk image named "Werkbit.app" carrying developer ID "Emil Grigorov (WWB7JA7AQV)", which lets it pass Gatekeeper checks, with the download gated behind a meeting PIN and served from werkbit[.]io, a domain registered in June 2026.
What's compelling: A valid Apple notarization and developer ID now clear Gatekeeper for a stealer that unlocks the login keychain, so the check your Mac fleet relies on is no longer a signal of trust. The operators also gate the installer behind a meeting PIN, meaning only targeted visitors receive it and broad scanning will not surface the payload.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026