{"id":56217,"date":"2026-08-03T10:01:21","date_gmt":"2026-08-03T14:01:21","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=56217"},"modified":"2026-08-03T10:07:40","modified_gmt":"2026-08-03T14:07:40","slug":"crashstealer-werkbit-macos-infostealer","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/crashstealer-werkbit-macos-infostealer\/56217\/","title":{"rendered":"CrashStealer: notarized malware for macOS"},"content":{"rendered":"

Mac users have historically trusted their operating system to keep them safe. That peace of mind mostly comes from Apple\u2019s strict control over its ecosystem, and the fact that macOS has historically faced fewer mass attacks than Windows. However, that doesn\u2019t mean Macs are invulnerable: threats do exist, and new ones emerge all the time. Over just the past few weeks, security researchers have published reports on at least two new campaigns that target Apple devices.<\/p>\n

The malware used in one of the campaigns has been dubbed CrashStealer<\/a>, while the other is known as ClickLock<\/a>. Both rely on different tricks to force users into entering their Mac password, which attackers then use to steal account credentials, crypto assets, documents, and much more. In today\u2019s post, we take a close look at how CrashStealer operates\u00a0\u2014 and how to avoid falling victim to it.<\/p>\n

A videoconferencing app with CrashStealer inside<\/h2>\n

It was back in May 2026 that researchers spotted the first signs this malware was being developed, and by early July, they caught it operating in the wild. The malware earned its name because of its core mechanism: it disguises itself as the macOS built-in crash reporting tool (CrashReporter) while functioning as an infostealer designed to hijack sensitive data.<\/p>\n

Researchers managed to trace one of the websites users visited to download the malware. The site poses as a legitimate platform for distributing the video conferencing tool Werkbit.<\/p>\n

\"A<\/a>

According to researchers, this is the site victims used to download Werkbit, which secretly contained the CrashStealer malware loader. Source <\/a><\/p><\/div>\n

However, you can\u2019t just visit the site and download the software. Before downloading, visitors are asked to enter a special meeting PIN. This setup likely allows the attackers to limit the distribution scope by targeting only specific, pre-selected victims. Exactly how the cybercriminals choose their targets and deliver the PIN remains unknown.<\/p>\n

The \u201clucky\u201d users with a code end up installing the initial malicious payload \u2014 named Werkbit Setup. Interestingly, it carries a valid Apple developer certificate and has successfully passed Apple\u2019s notarization process\u00a0\u2014 meaning it cleared the automated prescan for malicious code. As a result, the attackers manage to bypass the operating system\u2019s built-in Gatekeeper defense. This allows the payload to launch without triggering the usual untrusted software warnings.<\/p>\n

\"Signed<\/a>

The Werkbit Setup installer is signed with a valid Apple developer certificate and has passed notarization. Source <\/a><\/p><\/div>\n

Once launched, Werkbit Setup first reaches out to GitHub. Researchers believe using this popular platform helps attackers blend in by making these initial network requests look far less suspicious to security tools. After retrieving instructions from a GitHub repository, the program connects directly to the attackers\u2019 server to fetch CrashStealer itself.<\/p>\n

The loader then saves the malware to a temporary macOS folder, launches it, and wipes most of the intermediate setup files. As a result, a fully functional infostealer is up and running within seconds of Werkbit Setup starting. By the way, the user never gets any videoconferencing app.<\/p>\n

How CrashStealer works<\/h2>\n

Unlike the Werkbit Setup loader, the CrashStealer malware itself isn\u2019t signed with an Apple developer certificate. To keep users from suspecting anything, the malware disguises itself as the built-in macOS crash reporting tool, CrashReporter, by using the exact same name, app identifier, and a similar icon.<\/p>\n

Once launched, CrashStealer completes a sequence of steps to gain access to sensitive data, establish persistence in the system, and cover its tracks:<\/p>\n

    \n
  1. Remove metadata \u2014 including the attribute that flags the app as an internet download.<\/li>\n
  2. Display a fake system prompt asking for the user\u2019s macOS password.<\/li>\n
  3. Use the previously captured credentials to gain access to Keychain, the built-in macOS password manager.<\/li>\n
  4. Check the computer for installed security tools and malware analysis software.<\/li>\n
  5. Collect saved browser passwords, cookies, Keychain contents, and data from other password managers and crypto wallets.<\/li>\n
  6. Encrypt the data it stole and prepare it for forwarding to the attackers\u2019 server.<\/li>\n
  7. Create a copy of itself and establish persistence to launch automatically every time macOS boots.<\/li>\n
  8. Delete temporary files and other installation traces to make detection much harder.<\/li>\n<\/ol>\n

    Step two deserves a closer look. The password prompt that the user sees looks extremely convincing. What\u2019s more, the malware immediately verifies whether the credentials are correct: if you make a typo and enter an invalid password, CrashStealer will pop the window right back up to ask you again.<\/p>\n

    \"Fake<\/a>

    Once launched, CrashStealer displays a pop-up that mimics the standard macOS password request. Source <\/a><\/p><\/div>\n

    What data is CrashStealer after?<\/h2>\n

    CrashStealer\u2019s hit list is massive. First and foremost, its operators target Keychain: the built-in macOS password manager where the system stores account credentials, cryptographic keys, certificates, tokens, and more.<\/p>\n

    Users of third-party password managers aren\u2019t safe either: the malware steals data from 14 of these services, including 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass, and RoboForm.<\/p>\n

    In addition, the malware collects all credentials and cookies stored in Chromium-based browsers\u00a0\u2014 Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium, and NAVER Whale\u00a0\u2014 as well as Firefox. The attackers clearly have a strong interest in crypto assets: CrashStealer specifically targets data from 80 different crypto wallet extensions, including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, Exodus, Keplr, and Solflare.<\/p>\n

    Finally, the malware scans the Documents and Downloads folders to pick files that might be of interest to the cybercriminals. CrashStealer encrypts all the stolen data with the AES-256-GCM algorithm, ZIP\u2019s it up, and sends it to the attackers\u2019 server.<\/p>\n

    How to protect your device<\/h2>\n

    The spike in attacks on macOS is a clear wake-up call: Apple users need to get proactive about their security. We recommend:<\/p>\n