Gatekeeper is the thing standing between a Mac user and a bad afternoon. It is supposed to stop unsigned software from running on first launch. So it’s worth being precise about what happened here: the malware didn’t defeat Gatekeeper. It brought a valid Apple developer ID and a notarization ticket, and Gatekeeper waved it through without a warning.

According to Jamf Threat Labs, which published its analysis Monday, a new macOS infostealer dubbed CrashStealer is delivered via a signed and Apple-notarized dropper distributed as a disk image named “Werkbit Setup.” Because the dropper carries a valid Developer ID and a stapled notarization ticket, it clears Gatekeeper on first launch — in contrast to the ad-hoc-signed payload it goes on to install. Jamf reports the payload is a native C++ infostealer, and per Forbes’ account of the research, it targets Keychain-stored secrets including credentials for websites, Wi-Fi networks, and encrypted disk images, along with Chrome and Firefox cookies and passwords, 14 password managers, 80 cryptocurrency wallets, and files in Documents and Downloads. Jamf reported the Developer Team ID to Apple, and Apple has said it revoked the credentials associated with the application.

The lure and the disguise

Per SC Media’s reporting on the Jamf research, the dropper “Werkbit” is disguised as a video conferencing platform, and social media users have previously reported being asked to install Werkbit to attend interviews for dubious work opportunities. BleepingComputer notes the first-stage payload is hosted on a fake software site registered in late June, with the download gated behind a meeting PIN — a filter that keeps casual analysts out and lends the whole thing an air of legitimacy.

Once installed, the malware leans hard on impersonation. The binary takes the name CrashReporter.app, creates a LaunchAgent named after Apple’s crash reporter, and uses the legitimate tool’s icon and metadata. It then displays a native-looking password prompt styled to resemble a genuine macOS authorization request — because the Keychain is the prize, and the Keychain needs the login password. Jamf notes the payload re-signs itself, which rewrites the code-signature data so the file’s hash changes even though the code doesn’t.

Jamf’s assessment is that what distinguishes CrashStealer from the commodity stealer crowd is less what it collects than how it’s built — client-side AES-GCM encryption of collected files, plus analysis resistance through control-flow flattening, encrypted strings, and layered anti-debugging.

What to do about it

• Treat ‘install this app for the interview’ as hostile: The lure here is a fake conferencing tool pushed at job seekers. If a recruiter needs you to sideload an installer from a site you’ve never heard of, that’s the attack.
• Distrust unexpected password prompts: A dialog asking for your Mac login password out of nowhere deserves suspicion, not muscle memory. That prompt is how the Keychain opens.
• Hunt Jamf’s detection opportunities: Watch for ad-hoc re-signing of the payload, execution of an app bundle from the hidden temp path, the dscl process being spawned to verify a user’s password, and stolen-data archives left under the crash reporter cache directory.
• Assume identity blast radius, not just device cleanup: As Jamf frames it, the real question isn’t which Macs are infected — it’s which identities, SaaS apps, cloud roles, code repositories, and production systems those Macs could reach. Rotate accordingly.
• Don’t treat notarization as a verdict: Signed and notarized means “Apple checked some boxes,” not “this is safe.”

The outrage

Notarization was sold to users as a meaningful safety signal — the reassurance that Apple had looked at this thing. And here is a credential stealer that sailed through with a valid Developer ID, cleared Gatekeeper silently, and then had the nerve to dress up as Apple’s own crash reporter to steal the user’s Keychain. The trust infrastructure didn’t just fail to stop the attack; it actively vouched for it.

Apple revoked the certificate once Jamf reported it, which is the right move and also a reminder of the underlying economics: developer certificates are obtainable, revocation is reactive, and the gap in between is somebody’s entire campaign. Meanwhile the victims here are people applying for jobs, asked to install a meeting app by someone they believed was a recruiter. Punch up at the trust model, not at them. And maybe stop telling users that a “verified developer” badge means anything more than paperwork.