CrashStealer: New macOS Infostealer Uses Signed Apps to Evade Gatekeeper

CrashStealer is a sophisticated macOS infostealer delivered via a signed and notarized dropper (Werkbit.app) that bypasses Gatekeeper, fetches and re-signs a payload (CrashReporter.app), prompts victims for passwords to unlock keychains, harvests browser credentials, ~80 crypto wallet extensions and multiple password managers, stages and AES-256-GCM encrypts collected artifacts, persists via a LaunchAgent, and employs control-flow flattening, encrypted strings, and anti-debugging; defenders can hunt for .zx_*.zip archives under ~/.cache/com.apple.crashreporter/ and block known domains/IPs and the reported Developer Team ID.