CrashStealer Native C++ macOS Information Stealer

Security researchers have identified CrashStealer, a sophisticated macOS-targeted information stealer implemented in native C++. The malware is notable for its highly professional delivery chain, utilizing a signed and Apple-notarized dropper (named "Werkbit") to successfully bypass Gatekeeper security checks. Once executed, it impersonates legitimate Apple crash-reporting components to gain user trust and harvest a wide array of sensitive data.

The attack chain involves a multi-stage loading process where a notarized disk image fetches an obfuscated shell script from GitHub, which then stages the final payload. Technically, CrashStealer distinguishes itself through the use of client-side AES-256-GCM encryption for stolen data, control-flow flattening to resist analysis, and local password validation via the `dscl` utility.

This threat is part of a larger, potentially multi-platform campaign using gated distribution methods (meeting PINs) to target specific users. Its ability to collect data from over 80 cryptocurrency wallets and 14 password managers makes it a high-priority threat for financial and enterprise sectors using macOS environments.