- How Cthulhu Stealer Works
- Consequences of Infection
- Connection with Other Malware
A new malware called “Cthulhu Stealer” poses a significant risk to Apple Mac users by stealing personal data and cryptocurrency wallets.
How Cthulhu Stealer Works
“Cthulhu Stealer” disguises itself as legitimate software such as CleanMyMac and Adobe GenP, tricking users into downloading it. The malware is delivered as an Apple Disk Image (DMG) file. When opened, it uses the macOS command-line tool to prompt users for their passwords. Once the password is entered, the malware then asks for access to cryptocurrency wallets like MetaMask, a popular Ethereum wallet, as well as other major wallets such as those from Coinbase, Binance, and Blockchain Wallet.
Consequences of Infection
The stolen information is saved in text files and includes data like IP addresses and operating system versions. The primary function of “Cthulhu Stealer” is to collect credentials, cryptocurrency wallets, and even gaming accounts. The malware shows a significant increase in attacks on macOS, supported by Cado Security researcher Tara Gould.
Connection with Other Malware
“Cthulhu Stealer” shares characteristics with the malware “Atomic Stealer,” identified in 2023, indicating that its developer may have used the same code with some modifications. Moreover, the malware was rented out for $500 per month through Telegram, with profits shared among affiliates. However, disputes among the scammers have reportedly led to accusations of an exit scam, causing the operation to go inactive.
Malware like “Cthulhu Stealer” continues to evolve, posing a serious threat to Mac users' data security. Users should be extremely cautious when downloading software from unreliable sources and follow cybersecurity recommendations.
