Execution of notarized Werkbit dropper impersonating CrashReporter

Duo Tech@duotech

•updated Jul 14, 2026•1•0•1

Detects the execution of a process named 'Werkbit' or containing 'Werkbit' in its command line that is associated with 'com.apple.crashreporter' but is located outside the standard '/Applications/' directory on macOS. This behavior may indicate an attempt to masquerade or execute unauthorized code disguised as a crash reporting process.