New MacOS Malware Exploits Legitimate Developer ID to Pose as Apple Crash Reporter

CrashStealer is a newly observed macOS infostealer delivered via a notarized, developer-signed disk image (reported as "Werkbit Setup") that impersonates Apple's crash-reporting component to bypass Gatekeeper and trick users into running a dropper; after installation it prompts for system credentials and exfiltrates browser passwords, cryptocurrency wallet logins and keychain data, employing client-side AES-GCM encryption, control-flow flattening, encrypted strings and layered anti-debugging to resist analysis.