This fake Apple app can unlock your Mac’s password vault

CrashStealer is a macOS infostealer masquerading as CrashReporter.app that uses an Apple‑notarized installer called “Werkbit Setup” distributed from a PIN‑gated fake site to bypass Gatekeeper. It presents a fake password prompt to unlock the user’s Keychain, harvests browser credentials, cookies, password manager data, crypto wallet extensions, and small user files, then exfiltrates the data in AES‑encrypted bundles; Malwarebytes detects it as MacOS.Stealer.Crash. The report warns that notarization can be abused and recommends cautious user behavior, verifying installs, using reputable macOS security software, and separating high‑value assets.