CrashStealer Fakes macOS Crash Reporter to Steal Passwords

How the attack worked

CrashStealer begins as a fake collaboration app called Werkbit, distributed through a PIN-gated disk image that adds a layer of false legitimacy to the installation process. Once installed, the malware does not immediately ask for anything unusual. Instead, it impersonates Apple's own crash-reporting component, copying its bundle identifier, icon, and even installing a LaunchAgent named to look like a genuine Apple system process.

With that disguise in place, CrashStealer displays a fake macOS password prompt. The prompt includes explanatory text written by the malware's developer specifically to make a request for broad system access sound like routine maintenance rather than a credential grab. Once a user enters their password, it is verified locally and then used to unlock Keychain data and credentials stored in user folders.

Why it succeeded

Several layers of manufactured trust make this attack effective:

• The app was signed and notarised through an Apple developer account, which allowed it to bypass macOS Gatekeeper warnings until Apple revoked the credentials.
• It impersonated a core Apple system component rather than a third-party tool, borrowing the credibility users associate with built-in macOS processes.
• The PIN-gated installer created an impression of exclusivity or official process, discouraging suspicion.
• The password prompt's wording was crafted to sound like ordinary system maintenance, not a security-sensitive action.

Because each of these elements reinforces the others, a user who might question one signal in isolation is less likely to question the combination.

What to watch for

Defenders and everyday macOS users should be alert to:

• Any newly installed application asking for your macOS password shortly after installation, especially framed as maintenance or a system update.
• Installers that require unusual steps, such as a PIN, to proceed, which can be used to simulate an official or vetted process.
• Apps claiming to be collaboration or productivity tools that do not actually provide meaningful collaboration features.
• Reliance on notarisation as a sole indicator of trust. Notarisation confirms code signing, not that the software itself is legitimate.

Building resistance

Organisations with macOS endpoints should reinforce that password prompts appearing after installing a new app are not routine and should be verified with IT before any credentials are entered. Security awareness efforts should also cover how attackers can fake legitimacy through corporate-looking websites, claimed customer logos, or valid-seeming signing credentials, since none of these alone confirm that software is safe. Encouraging users to pause and verify the source of an installer, particularly one that adds artificial friction like a PIN gate, can reduce the chance that a convincing disguise leads to a real credential compromise.

What is CrashStealer?

CrashStealer is a macOS infostealer that disguises itself as a collaboration app called Werkbit and then impersonates Apple's crash-reporting component to steal Keychain and browser credentials.

How does CrashStealer trick users into giving up their password?

After installation, it displays a fake macOS password prompt with explanatory text designed to make the request for broad system access sound like routine maintenance.

Does Apple notarisation mean an app is safe?

No. CrashStealer was signed and notarised via an Apple developer account, which helped it bypass Gatekeeper warnings until Apple revoked the credentials, showing notarisation alone does not vet the software.

What are the warning signs of this attack?

Red flags include a newly installed app requesting your macOS password for routine maintenance, a PIN-gated installer used to add false legitimacy, and a collaboration tool that provides no real collaboration features.