CrashStealer macOS Stealer Uses Notarized Dropper to Pass Gatekeeper
Summary
Jamf Threat Labs describes CrashStealer, a native C++ macOS stealer delivered through a signed, notarized dropper. It collects credentials and other sensitive files, encrypts them with AES-GCM, and exfiltrates them to an attacker-controlled server.
Key points
- Jamf Threat Labs reports that CrashStealer is a native C++ macOS information stealer.
- Its delivery uses the signed and notarized Werkbit.app disk image, which passes Gatekeeper checks; the image is hosted at werkbit[.]io.
- After launch, the veltod executable retrieves sys.cache from github[.]com/mgothiclove, then uses a shell script to fetch and stage CrashReporter.dmg.
- The malware establishes persistence as a LaunchAgent, resists analysis, and validates the victim’s password locally before accessing the login keychain.
- It targets browser credentials, cryptocurrency wallet extensions, password-manager data, keychain material, and files in Documents and Downloads.
- Collected data is packaged into a ZIP archive, encrypted with AES-GCM, and sent to an attacker-controlled server at 179.43.166.242.
Article Details
- Attack Vectors
- A signed and Apple-notarized disk image named Werkbit.app is distributed from werkbit[.]io and passes Gatekeeper checks.
- The download is gated behind a meeting PIN, and the installer instructs users to right-click and open the app.
- After launch, the veltod executable retrieves sys.cache from a GitHub repository; a command extracted from that file downloads a shell script that stages CrashReporter.dmg in /tmp.
- CrashStealer establishes persistence as a LaunchAgent, prompts for the victim’s password, and validates it locally before accessing the login keychain and collecting data.
- Collected data is packaged into a ZIP archive, encrypted with AES-GCM, and sent to an attacker-controlled server.
- Defensive Notes
- Treat the Werkbit.app disk image and related downloads as malicious despite their valid developer ID and notarization.
- Investigate unexpected LaunchAgent persistence and processes that retrieve sys.cache or stage CrashReporter.dmg in /tmp.
- Monitor for unauthorized collection of browser, wallet, password-manager, keychain, Documents, and Downloads data, followed by outbound connections to 179.43.166[.]242.
- Review endpoints for CrashStealer’s reported analysis-evasion behavior, including control-flow flattening, encrypted strings, and anti-debugging.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | werkbit[.]io | Domain from which the article says the malicious Werkbit.app disk image originates. |
| IPV4 | 179[.]43[.]166[.]242 | Attacker-controlled server identified as the destination for exfiltrated data. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collects files from the victim’s Documents and Downloads directories.T1027 · Obfuscated Files or InformationThe article reports control-flow flattening and encrypted strings as analysis-resistance measures.T1056.002 · GUI Input CaptureThe malware presents a password prompt and validates the entered credential locally.T1059.004 · Unix ShellA shell script acts as a downloader for the next payload.T1105 · Ingress Tool TransferThe executable retrieves sys.cache, and a shell script downloads and stages CrashReporter.dmg.T1518.001 · Security Software DiscoveryThe malware lists installed security and analysis tooling.T1543.001 · Launch AgentCrashStealer persists as a LaunchAgent.T1553.001 · Gatekeeper BypassThe signed and notarized dropper passes macOS Gatekeeper checks.T1555.001 · KeychainThe malware unlocks and collects data from the login keychain using the validated password.T1555.003 · Credentials from Web BrowsersCrashStealer harvests credentials from Chromium-family browsers.T1555.005 · Password ManagersCrashStealer collects data from password managers, including those named in the article.T1560 · Archive Collected DataCollected data is packaged into a ZIP archive before exfiltration.T1622 · Debugger EvasionThe article reports layered anti-debugging behavior.
People
Malware
Vendors
Products
GatekeepermacOS information stealer built in native C++ that uses a signed and notarized dropper to bypass Gatekeeper, then harvests browser credentials, crypto wallets, password managers, and keychain data.macOSCrashStealer is a newly identified macOS information stealer built in native C++ that uses a signed and notarized dropper to bypass Gatekeeper, then harvests browser credentials, crypto wallets, password managers, and