Overview
- Jamf Threat Labs published detailed analysis on July 13–14, 2026 that traced the campaign to a notarized disk image called “Werkbit Setup” which fetched and staged a payload named CrashReporter.app.
- The installer used a valid Apple Developer ID to clear Gatekeeper and then the payload impersonated Apple’s CrashReporter, showing a native password prompt that validated credentials locally with the dscl utility.
- Once given a correct password, CrashStealer unlocked and copied the login Keychain, harvested browser data, roughly 80 crypto‑wallet extensions, 14 password managers, and selected user files, then encrypted each item with AES‑256‑GCM before exfiltration.
- The malware persists by copying itself to a hidden cache, re‑signing the copy ad hoc, and installing a LaunchAgent labeled com.apple.crashreporter.helper, and it includes multiple anti‑analysis checks to hinder investigation.
- Defenders should treat any Mac that ran the notarized dropper and had its password entered as compromised, hunt for artifacts like .zx_ hidden archives and the LaunchAgent, revoke exposed credentials, and follow vendor IOCs and forensic guidance.