CrashStealer Hides as Apple Crash Reporter

How the attack worked

CrashStealer begins with a disk image called "Werkbit Setup" that contains a single signed and Apple-notarized application, Werkbit.app. Because the app carries a valid Developer ID and a stapled notarization ticket, it clears Gatekeeper on first launch without triggering any macOS warning. Access to the installer is gated behind a meeting PIN, which keeps casual visitors from stumbling onto it and limits early detection.

Once run, the dropper pulls a command from GitHub API content, which triggers a Base64-delivered shell script. That script downloads a payload DMG over plain HTTP, mounts it without any verification, and runs the app from a hidden temporary directory. The payload impersonates Apple's built-in Crash Reporter, using the bundle identifier com.apple.crashreporter and a matching icon to appear legitimate.

Why it succeeded

The use of a genuinely signed and notarized dropper is what separates this campaign from a typical unsigned lure. Users and even security-conscious staff are trained to trust Gatekeeper's clearance as a signal of safety, but that signal does not confirm the app's behavior after launch. The fake Crash Reporter then leans on a familiar macOS interface, the native password prompt, to make credential capture feel routine rather than suspicious.

The malware also loops the password prompt until the correct password is entered, and it immediately reuses that password to unlock the login keychain. Broad permission requests, framed as needed "for system administration," extend access to Desktop, Documents, Downloads, and removable volumes.

What to watch for

• Software downloads gated behind a meeting PIN or similar unusual access step
• DMG or app installers distributed outside managed software channels or the Mac App Store
• Unexpected native password prompts from an app that was just installed
• A "crash reporter" or similar utility requesting Full Disk Access and broad folder permissions
• Hidden files with unusual naming patterns left behind after data is collected and encrypted locally

Building resistance

Organizations should reinforce that Gatekeeper clearance and Apple notarization do not guarantee an app is safe, since a signed and notarized dropper was central to this campaign. Staff should be encouraged to verify any unexpected installer request, particularly ones tied to a meeting invitation or PIN, through IT or security before running it. Most importantly, employees should treat any unexpected macOS password prompt from a newly installed app as a signal to stop and confirm with IT rather than complete it, and should question permission requests that go far beyond what the app claims to do.

How does CrashStealer bypass macOS Gatekeeper?

The initial dropper, Werkbit.app, is signed with a valid Apple Developer ID and carries a stapled notarization ticket, so it clears Gatekeeper on first launch without any warning to the user.

What does CrashStealer actually steal?

It targets major browsers, Firefox stores, many crypto wallet extensions, and popular password managers, and also searches Documents and Downloads folders for sensitive files.

Why does the malware ask for a Mac password?

It impersonates Apple's built-in Crash Reporter and shows a native macOS password prompt, looping until the correct password is entered so it can reuse that password to unlock the login keychain.

What are the warning signs of this attack?

Red flags include an installer download gated behind a meeting PIN, a newly registered distribution domain, and a supposed crash reporter requesting Full Disk Access plus Desktop, Documents, and Downloads permissions.