{"id":14773,"date":"2026-08-19T15:28:31","date_gmt":"2026-08-19T12:28:31","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=14773"},"modified":"2026-08-19T15:28:31","modified_gmt":"2026-08-19T12:28:31","slug":"crashstealer-werkbit-macos-infostealer","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/crashstealer-werkbit-macos-infostealer\/14773\/","title":{"rendered":"CrashStealer: macOS i\u00e7in noter onayl\u0131 k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m"},"content":{"rendered":"

Mac kullan\u0131c\u0131lar\u0131, ge\u00e7mi\u015ften beri i\u015fletim sistemlerinin kendilerini g\u00fcvende tutaca\u011f\u0131na g\u00fcvenmi\u015flerdir. Bu i\u00e7 huzur, b\u00fcy\u00fck \u00f6l\u00e7\u00fcde Apple\u2019\u0131n kendi ekosistemi \u00fczerindeki s\u0131k\u0131 kontrol\u00fcnden ve macOS\u2019un tarihsel olarak Windows\u2019a k\u0131yasla daha az kitlesel sald\u0131r\u0131ya maruz kalm\u0131\u015f olmas\u0131ndan kaynaklanmaktad\u0131r. Ancak bu, Mac\u2019lerin hi\u00e7bir tehdide maruz kalmad\u0131\u011f\u0131 anlam\u0131na gelmez: Tehditler her zaman varl\u0131\u011f\u0131n\u0131 s\u00fcrd\u00fcr\u00fcr ve her an yenileri ortaya \u00e7\u0131kar. Sadece son birka\u00e7 hafta i\u00e7inde, g\u00fcvenlik ara\u015ft\u0131rmac\u0131lar\u0131 Apple cihazlar\u0131n\u0131 hedef alan en az iki yeni sald\u0131r\u0131 kampanyas\u0131 hakk\u0131nda raporlar yay\u0131nlad\u0131.<\/p>\n

Sald\u0131r\u0131 kampanyalar\u0131ndan birinde kullan\u0131lan zararl\u0131 yaz\u0131l\u0131m CrashStealer<\/a>, di\u011ferinde ise ClickLock<\/a> olarak adland\u0131r\u0131ld\u0131. Her ikisi de, kullan\u0131c\u0131lar\u0131 Mac parolalar\u0131n\u0131 girmeleri i\u00e7in zorlamak amac\u0131yla farkl\u0131 y\u00f6ntemlere ba\u015fvuruyor; sald\u0131rganlar ise bu parolalar\u0131, hesap bilgilerini, kripto varl\u0131klar\u0131n\u0131, belgeleri ve daha pek \u00e7ok \u015feyi \u00e7almak i\u00e7in kullan\u0131yor. Bug\u00fcnk\u00fc yaz\u0131m\u0131zda, CrashStealer\u2019\u0131n nas\u0131l operat\u00f6r taraf\u0131ndan kullan\u0131ld\u0131\u011f\u0131n\u0131 ve bu sald\u0131r\u0131n\u0131n kurban\u0131 olmamak i\u00e7in neler yapabilece\u011fimizi ayr\u0131nt\u0131l\u0131 olarak ele al\u0131yoruz.<\/p>\n

\u0130\u00e7inde CrashStealer bulunan bir video konferans uygulamas\u0131<\/h2>\n

Ara\u015ft\u0131rmac\u0131lar, bu zararl\u0131 yaz\u0131l\u0131m\u0131n geli\u015ftirilmekte oldu\u011funa dair ilk i\u015faretleri 2026 y\u0131l\u0131n\u0131n May\u0131s ay\u0131nda fark etmi\u015flerdi ve Temmuz ay\u0131 ba\u015flar\u0131nda da bu yaz\u0131l\u0131m\u0131n ger\u00e7ek ortamda faaliyet g\u00f6sterdi\u011fini tespit ettiler. Bu zararl\u0131 yaz\u0131l\u0131m, temel \u00e7al\u0131\u015fma mekanizmas\u0131 nedeniyle bu ad\u0131 alm\u0131\u015ft\u0131r. Hassas verileri ele ge\u00e7irmek \u00fczere tasarlanm\u0131\u015f bir bilgi h\u0131rs\u0131z\u0131 olarak \u00e7al\u0131\u015fan bu yaz\u0131l\u0131m, kendini macOS\u2019un yerle\u015fik hata raporlama arac\u0131 (CrashReporter) gibi g\u00f6sterir.<\/p>\n

Ara\u015ft\u0131rmac\u0131lar, kullan\u0131c\u0131lar\u0131n zararl\u0131 yaz\u0131l\u0131m\u0131 indirmek i\u00e7in ziyaret ettikleri web sitelerinden birinin izini s\u00fcrmeyi ba\u015fard\u0131lar. Bu site, Werkbit adl\u0131 video konferans arac\u0131n\u0131 da\u011f\u0131tmak i\u00e7in yasal bir platform gibi g\u00f6r\u00fcnmektedir.<\/p>\n

\"Werkbit<\/a>

Ara\u015ft\u0131rmac\u0131lara g\u00f6re, bu site, kurbanlar\u0131n gizlice CrashStealer zararl\u0131 yaz\u0131l\u0131m y\u00fckleyicisini bar\u0131nd\u0131ran Werkbit\u2019i indirmek i\u00e7in kulland\u0131klar\u0131 sitedir. Kaynak <\/a><\/p><\/div>\n

Ancak, siteyi ziyaret edip yaz\u0131l\u0131m\u0131 \u00f6ylece indiremezsiniz. \u0130ndirme i\u015fleminden \u00f6nce, ziyaret\u00e7ilerden \u00f6zel bir toplant\u0131 PIN\u2019i girmeleri istenir. Bu yap\u0131, sald\u0131rganlar\u0131n yaln\u0131zca belirli, \u00f6nceden se\u00e7ilmi\u015f kurbanlar\u0131 hedef alarak sald\u0131r\u0131lar\u0131n\u0131n yay\u0131lma kapsam\u0131n\u0131 s\u0131n\u0131rlamalar\u0131na olanak tan\u0131yor olabilir. Siber su\u00e7lular\u0131n hedeflerini tam olarak nas\u0131l se\u00e7tikleri ve PIN kodunu nas\u0131l ilettikleri h\u00e2l\u00e2 bilinmemektedir.<\/p>\n

Kod sahibi \u201c\u015fansl\u0131\u201d kullan\u0131c\u0131lar; ilgin\u00e7 bir \u015fekilde ge\u00e7erli bir Apple geli\u015ftirici sertifikas\u0131na sahip ve Apple\u2019\u0131n tasdik s\u00fcrecini ba\u015far\u0131yla tamamlam\u0131\u015f, yani k\u00f6t\u00fc ama\u00e7l\u0131 kodlara y\u00f6nelik otomatik \u00f6n taramay\u0131 ge\u00e7mi\u015f olan Werkbit Setup adl\u0131 ilk zararl\u0131 y\u00fck\u00fc y\u00fcklemi\u015f olurlar. Sonu\u00e7 olarak sald\u0131rganlar, i\u015fletim sisteminin yerle\u015fik Gatekeeper savunmas\u0131n\u0131 a\u015fmay\u0131 ba\u015farm\u0131\u015flard\u0131r ve bu sayede y\u00fck, ola\u011fan g\u00fcvenilmez yaz\u0131l\u0131m uyar\u0131lar\u0131n\u0131 tetiklemeden ba\u015flat\u0131labilir.<\/p>\n

\"\u0130mzalanm\u0131\u015f<\/a>

Werkbit Setup y\u00fckleyicisi, ge\u00e7erli bir Apple geli\u015ftirici sertifikas\u0131yla imzalanm\u0131\u015ft\u0131r ve noter tasdiki s\u00fcrecinden ge\u00e7mi\u015ftir. Kaynak <\/a><\/p><\/div>\n

Werkbit Setup ba\u015flat\u0131ld\u0131\u011f\u0131nda ilk olarak GitHub\u2019a ba\u011flan\u0131r. Ara\u015ft\u0131rmac\u0131lar, bu pop\u00fcler platformun kullan\u0131lmas\u0131n\u0131n, sald\u0131rganlar\u0131n bu ilk a\u011f taleplerini g\u00fcvenlik ara\u00e7lar\u0131na \u00e7ok daha az \u015f\u00fcpheli g\u00f6r\u00fcn\u00fcr hale getirerek ortama uyum sa\u011flamas\u0131na yard\u0131mc\u0131 oldu\u011funa inan\u0131yor. GitHub deposundan talimatlar\u0131 ald\u0131ktan sonra, program CrashStealer program\u0131n\u0131 indirmek i\u00e7in do\u011frudan sald\u0131rganlar\u0131n sunucusuna ba\u011flan\u0131r.<\/p>\n

Ard\u0131ndan y\u00fckleyici, zararl\u0131 yaz\u0131l\u0131m\u0131 ge\u00e7ici bir macOS klas\u00f6r\u00fcne kaydeder, onu \u00e7al\u0131\u015ft\u0131r\u0131r ve ara kurulum dosyalar\u0131n\u0131n \u00e7o\u011funu siler. Sonu\u00e7 olarak, Werkbit Setup\u2019\u0131n ba\u015flat\u0131lmas\u0131ndan saniyeler sonra tam i\u015flevsel bir bilgi h\u0131rs\u0131z\u0131 \u00e7al\u0131\u015f\u0131r duruma gelir. Bu arada, kullan\u0131c\u0131 hi\u00e7bir zaman bir video konferans uygulamas\u0131na sahip olmaz.<\/p>\n

CrashStealer nas\u0131l \u00e7al\u0131\u015f\u0131r?<\/h2>\n

Werkbit Setup y\u00fckleyicisinin aksine, CrashStealer zararl\u0131 yaz\u0131l\u0131m\u0131n\u0131n kendisi bir Apple geli\u015ftirici sertifikas\u0131yla imzalanmam\u0131\u015ft\u0131r. Kullan\u0131c\u0131lar\u0131n \u015f\u00fcphelenmemesi i\u00e7in bu zararl\u0131 yaz\u0131l\u0131m, tam olarak ayn\u0131 ad\u0131, uygulama tan\u0131mlay\u0131c\u0131s\u0131n\u0131 ve benzer bir simgeyi kullanarak kendini macOS\u2019un yerle\u015fik hata raporlama arac\u0131 olan CrashReporter olarak gizlemektedir.<\/p>\n

CrashStealer, \u00e7al\u0131\u015ft\u0131r\u0131ld\u0131ktan sonra hassas verilere eri\u015fim sa\u011flamak, sistemde kal\u0131c\u0131 bir varl\u0131k olu\u015fturmak ve izlerini silmek i\u00e7in bir dizi ad\u0131m\u0131 tamamlar:<\/p>\n

    \n
  1. Meta verileri kald\u0131r\u0131r (uygulamay\u0131 internetten indirilen bir dosya olarak i\u015faretleyen \u00f6znitelik dahil).<\/li>\n
  2. Kullan\u0131c\u0131n\u0131n macOS parolas\u0131n\u0131 isteyen, sahte bir sistem uyar\u0131s\u0131 g\u00f6r\u00fcnt\u00fcler.<\/li>\n
  3. Daha \u00f6nce elde edilen kimlik bilgilerini kullanarak, macOS\u2019un yerle\u015fik parola y\u00f6neticisi olan Keychain\u2019e eri\u015fir.<\/li>\n
  4. Bilgisayarda y\u00fckl\u00fc g\u00fcvenlik ara\u00e7lar\u0131n\u0131 ve zararl\u0131 yaz\u0131l\u0131m analiz yaz\u0131l\u0131mlar\u0131n\u0131 kontrol eder.<\/li>\n
  5. Taray\u0131c\u0131da kay\u0131tl\u0131 parolalar\u0131, \u00e7erezleri, Anahtar Zinciri i\u00e7eri\u011fini ve di\u011fer parola y\u00f6neticileriyle kripto c\u00fczdanlar\u0131ndaki verileri toplar.<\/li>\n
  6. \u00c7ald\u0131\u011f\u0131 verileri \u015fifreler ve sald\u0131rganlar\u0131n sunucusuna iletilmek \u00fczere haz\u0131rlar.<\/li>\n
  7. Kendi kopyas\u0131n\u0131 olu\u015fturur ve macOS her a\u00e7\u0131ld\u0131\u011f\u0131nda otomatik olarak ba\u015flat\u0131lmas\u0131 i\u00e7in kal\u0131c\u0131 ayarlar\u0131 yap\u0131land\u0131r\u0131r.<\/li>\n
  8. Tespit edilmesini \u00e7ok daha zor hale getirmek i\u00e7in ge\u00e7ici dosyalar\u0131 ve di\u011fer kurulum iz dosyalar\u0131n\u0131 siler.<\/li>\n<\/ol>\n

    \u0130kinci ad\u0131m daha yak\u0131ndan incelenmeyi hak etmektedir. Kullan\u0131c\u0131n\u0131n g\u00f6rd\u00fc\u011f\u00fc parola sorgulama penceresi son derece inand\u0131r\u0131c\u0131 g\u00f6r\u00fcnmekte; dahas\u0131, zararl\u0131 yaz\u0131l\u0131m, kimlik bilgilerinin do\u011fru olup olmad\u0131\u011f\u0131n\u0131 an\u0131nda kontrol etmektedir: E\u011fer yaz\u0131m hatas\u0131 yap\u0131p ge\u00e7ersiz bir parola girerseniz, CrashStealer pencereyi hemen yeniden a\u00e7arak sizden tekrar girmenizi ister.<\/p>\n

    \"Sahte<\/a>

    CrashStealer, ba\u015flat\u0131ld\u0131\u011f\u0131nda standart macOS parola talebini taklit eden bir a\u00e7\u0131l\u0131r pencere g\u00f6r\u00fcnt\u00fcler. Kaynak <\/a><\/p><\/div>\n

    CrashStealer hangi verilerin pe\u015finde?<\/h2>\n

    CrashStealer\u2019\u0131n hedef listesi \u00e7ok geni\u015f. Her \u015feyden \u00f6nce operat\u00f6rler; sistemin hesap kimlik bilgilerini, \u015fifreleme anahtarlar\u0131n\u0131, sertifikalar\u0131, belirte\u00e7leri ve daha fazlas\u0131n\u0131 depolad\u0131\u011f\u0131, macOS\u2019un yerle\u015fik parola y\u00f6neticisi olan Keychain\u2019i hedef al\u0131yor.<\/p>\n

    \u00dc\u00e7\u00fcnc\u00fc taraf parola y\u00f6neticisi kullan\u0131c\u0131lar\u0131 da g\u00fcvende de\u011fil: Zararl\u0131 yaz\u0131l\u0131m, 1Password, Bitwarden, LastPass, Dashlane, Keeper, KeePassXC, NordPass, Enpass ve RoboForm dahil olmak \u00fczere bu hizmetlerden 14\u2019\u00fcnden veri \u00e7al\u0131yor.<\/p>\n

    Buna ek olarak, zararl\u0131 yaz\u0131l\u0131m, Chromium tabanl\u0131 taray\u0131c\u0131larda (Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Chromium ve NAVER Whale) ve Firefox\u2019ta depolanan t\u00fcm kimlik bilgilerini ve \u00e7erezleri topluyor. Sald\u0131rganlar\u0131n kripto varl\u0131klar\u0131na a\u00e7\u0131k\u00e7a b\u00fcy\u00fck bir ilgisi var: CrashStealer, MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Rabby, Exodus, Keplr ve Solflare dahil olmak \u00fczere 80 farkl\u0131 kripto c\u00fczdan eklentisinden gelen verileri \u00f6zellikle hedef al\u0131yor.<\/p>\n

    Son olarak, zararl\u0131 yaz\u0131l\u0131m, siber su\u00e7lular\u0131n ilgisini \u00e7ekebilecek dosyalar\u0131 se\u00e7mek i\u00e7in Belgeler ve \u0130ndirilenler klas\u00f6rlerini tar\u0131yor. CrashStealer, \u00e7al\u0131nan t\u00fcm verileri AES-256-GCM algoritmas\u0131yla \u015fifreliyor, ZIP dosyas\u0131na s\u0131k\u0131\u015ft\u0131r\u0131yor ve sald\u0131rganlar\u0131n sunucusuna g\u00f6nderiyor.<\/p>\n

    Cihaz\u0131n\u0131z\u0131 nas\u0131l koruyabilirsiniz?<\/h2>\n

    macOS\u2019a y\u00f6nelik sald\u0131r\u0131lardaki art\u0131\u015f, a\u00e7\u0131k bir uyar\u0131 niteli\u011findedir: Apple kullan\u0131c\u0131lar\u0131, g\u00fcvenlik konusunda proaktif davranmal\u0131d\u0131r. \u00d6nerimiz:<\/p>\n