Ad-hoc codesign re-signing of downloaded macOS payload (CrashStealer)

Duo Tech@duotech

•updated Jul 14, 2026•0•0•5

Detects the use of the macOS 'codesign' utility to sign binaries using a self-signed or empty identity certificate. This technique is often used by adversaries to bypass Gatekeeper security controls or to make unsigned malicious binaries appear legitimate.