CrashStealer Tricks Users to Bypass macOS Gatekeeper

How the attack worked

CrashStealer is macOS info-stealing malware distributed through a dropper called Werkbit.app that is signed and Apple-notarized, allowing it to pass Gatekeeper checks that normally flag unverified software. Instead of freely publishing the installer, the operators gated the download behind a meeting PIN, limiting exposure only to visitors who arrived with the correct code. Once downloaded, the disk image presented an installation screen instructing users to right-click the app and choose Open rather than double-clicking it normally, a manual step that gets users to run the app in a way that avoids typical launch friction.

After execution, the dropper contacted a GitHub repository to retrieve a file, extracted a curl command from it, downloaded a shell script, and used that to fetch a second-stage payload. The malware then displayed a password prompt, validated the entered credential locally, and used it to unlock the user's login keychain, ultimately stealing credentials and wallet data. Stolen information was sent to an attacker-controlled server.

Why it succeeded

This chain worked because it exploited trust signals that users are trained to look for. A signed and notarized app is exactly what security guidance tells people to expect from legitimate software, so the presence of Gatekeeper approval made the installer appear safe. The PIN-gated download also created a false sense of exclusivity and legitimacy, as if the software were being shared through a private, trusted channel rather than broadly distributed. Combined with clear, confident on-screen instructions to right-click and Open, the process felt like a normal setup flow rather than a security bypass.

What to watch for

• Instructions that explicitly tell you to right-click and choose Open instead of the standard double-click launch
• Software downloads gated behind a meeting PIN or access code, which is unusual for typical business software
• A password prompt appearing immediately after launching a newly downloaded app, especially when there is no clear reason it needs your login credentials
• Unexpected outbound network activity to unfamiliar domains, GitHub repositories used for staging files, or unknown IP addresses

Building resistance

Employees should treat right-click to Open instructions as a red flag regardless of whether the app appears signed or notarized, since notarization confirms code signing but not intent. Teams should also verify unusual distribution methods, such as PIN-gated downloads, with IT before installing anything. Most importantly, users should never enter their macOS login password into an app they just downloaded unless they initiated a known, approved action and can confirm why the credential is needed. IT and security teams can reinforce this by monitoring for connections to unusual infrastructure used to retrieve staged payloads.

How does CrashStealer bypass macOS Gatekeeper?

CrashStealer is distributed through a signed and Apple-notarized dropper called Werkbit.app, which allows it to pass Gatekeeper checks that normally block unverified software.

Why does CrashStealer ask users to right-click and choose Open?

The installer instructs users to right-click the app and select Open specifically to get them to run it, a technique that sidesteps macOS's normal launch warnings even though the app is notarized.

Why does the malware ask for the macOS login password?

After execution, CrashStealer presents a password prompt and validates the entered credential locally, then uses it to unlock the login keychain and steal credentials and wallet data.

What should macOS users watch for to avoid this kind of attack?

Be suspicious of any install process that requires a special PIN to download, instructs a manual right-click to Open, or asks for your login password shortly after launching a newly downloaded app.