MacSouverain

FREN
radar

Apple-notarized malware slips past Gatekeeper

CrashStealer, signed and notarized by Apple, clears Gatekeeper without a single alert. Notarization validates the signature, not the intent.

A piece of malware disguises itself as an Apple crash-reporting tool. It’s signed by a valid Developer ID and notarized by Apple itself. The result, it clears Gatekeeper without the slightest warning, because your Mac checks the signature, never the intent.


The fact


Jamf Threat Labs spotted a suspicious sample on VirusTotal in early May 2026, then observed real infections on client Macs in early July. The malware is called CrashStealer. A rare trait, it’s written in native C++, where the vast majority of macOS stealers cobble something together in AppleScript. It poses as an Apple crash-reporting tool, the kind of window you’ve seen a hundred times without paying attention.


The delivery is polished. The malware arrives in a disk image named “Werkbit,” and the app inside is called “Werkbit.app.” Notably, the DMG itself is signed, not just the app it contains. The certificate, a Developer ID under the name “Emil Grigorov” (WWB7JA7AQV), valid, active, notarized by Apple. The distribution domain, werkbit[.]io, was registered in June 2026, and the download is locked behind a meeting PIN code. Translation, the installer is served only to chosen victims, never to automated scanners or the passing visitor.


Once launched, the dropper pulls the real payload from the attacker’s infrastructure. Before harvesting anything, it shows you a fake system prompt and validates your session password locally. Then it drains everything, browser profiles, the Keychain, fourteen password managers (1Password, Bitwarden, LastPass, Dashlane, Keeper included) and close to eighty crypto wallet extensions. The loot is encrypted with AES-GCM then exfiltrated over libcurl. It copies and re-signs itself to persist.


Apple revoked the signing certificate after Jamf’s report. The damage was already done for those who had clicked.


Why Gatekeeper saw nothing


Here’s the knot. Apple notarization is not a security audit. It’s an automated scan that looks for signatures of already-known malware and checks that the binary is signed by a valid Developer ID. Nothing more. Apple didn’t read CrashStealer’s code, it didn’t judge its intent, it passed a binary that was clean at scan time through a grinder that saw nothing familiar.


The notarization stamp says one thing, “this file is signed by an identified developer and matches no known malware.” It doesn’t say “this software is safe.” The nuance sounds theoretical. It’s the whole point.


An attacker who opens an Apple Developer account for 99 dollars a year, under a credible identity, gets a pass to clear Gatekeeper in silence. Apple’s kill-switch, revoking the certificate, only kicks in after the fact, once the damage is documented. Apple pushes its defenses silently, it doesn’t warn you when it has let something through. It’s a firefighter, not a guard.


Read more: Your Mac got patched by XProtect without you knowing


What it changes for you


The collective reflex, “it’s Apple-signed, so it’s fine,” just took a bullet. Your Mac trusts the signature, not the intent behind it. A notarized binary is not a blessed binary. It’s a binary whose declared author is known, useful for going after them afterward, useless for sparing you the infection.


The meeting-PIN targeting also changes the game. This malware isn’t trawled off a warez forum. It comes by invitation, in a context that looks professional, served to you and not to a scanner. The old reflex “I only download known stuff” no longer holds when the link is handed to you personally.


The real line of defense isn’t the Apple stamp. It’s you, your suspicion, and a tool that sees what the software actually does once it’s launched, its outbound connections.


What you do now


1. Treat any app or DMG received outside the App Store as suspect by default, especially when it arrives by invitation, direct link, or an “install this for the meeting” message. The Apple signature doesn’t redeem a dubious provenance. If you didn’t go looking for it yourself, you don’t install it.


2. A genuine macOS system prompt doesn’t ask again for your admin password without a clear reason. A freshly launched app that demands your login password “to continue,” with no legitimate install underway, is a red flag, not a formality. You close it, you type nothing.


3. Install an application firewall and let it speak. Little Snitch or LuLu show you the unexpected outbound connections, exactly the moment a stealer sets off to exfiltrate your loot. It’s your surveillance camera on what the system does behind your back.


Read more: Little Snitch vs LuLu, which outbound firewall for your Mac


And if you have the slightest doubt you ran a dubious installer recently, the drill already exists, it’s the same as for infostealers spread through social engineering.


Read more: Google Ads and a real shared Claude chat drain your credentials


Sources