CrashStealer bypasses macOS Gatekeeper with notarized dropper
CrashStealer bypasses macOS Gatekeeper with notarized dropper
CrashStealer is being distributed via a notarized macOS dropper, allowing the malware to pass Apple Gatekeeper checks and appear trusted at launch. The campaign highlights abuse of Apple’s app notarization workflow rather than a direct bypass of the security control itself, as outlined in CrashStealer coverage.
The operational takeaway is straightforward: notarization is not a guarantee of safety. For defenders, trust decisions based only on Gatekeeper or signing status leave a gap at initial execution, especially where malicious payload delivery is staged through seemingly legitimate installers.
️ Open sources - closed narratives
Source: Telegram "sitreports"