CrashStealer Malware Bypasses Apple Gatekeeper

CrashStealer, a macOS infostealer built in native C++, uses an Apple-notarized dropper named Werkbit to bypass Gatekeeper. It harvests browser data, cryptocurrency wallet extensions, password manager data, and keychain material, encrypts it with AES-GCM, and exfiltrates it via libcurl. The campaign extends to multiple platforms with shared backend infrastructure.