CrashStealer uses notarized Mac dropper to slip past Gatekeeper and steal credentials
CrashStealer is a native C++ macOS infostealer masquerading as Apple’s crash‑reporting framework. It arrives in a signed, notarized DMG called “Werkbit Setup,” which clears Gatekeeper and then installs the payload that harvests browsers, crypto wallets, password managers and the keychain, encrypting the loot with AES‑GCM before exfiltration. This shows attackers can exploit Apple’s notarization to bypass macOS defenses.