FX.co ★ New Malware 'Cthulhu Stealer' Targets MacOS Users

Cado Security, as reported by Hacker News, has discovered a new malware-as-a-service (MaaS) threat called "Cthulhu Stealer," which specifically targets Apple's macOS users by mimicking popular applications.

This malware is designed to harvest sensitive information from compromised Macs, including iCloud Keychain passwords, browser data, and Telegram account details. According to Tara Gould, a researcher at Cado Security, Cthulhu Stealer masquerades as legitimate software, feigning popular applications such as CleanMyMac, Grand Theft Auto IV, and Adobe GenP.

When users attempt to launch the counterfeit application, macOS’s Gatekeeper—an integrated security feature—warns that the software is unsigned. Ignoring this alert leads the malware to prompt users for their system password by posing as a legitimate system request. Similar techniques are employed by other Mac malware variants like Atomic Stealer, Cuckoo, MacStealer, and Banshee Stealer.

“The main functionality of Cthulhu Stealer is to steal credentials and cryptocurrency wallets from various storage locations, including game accounts,” Gould explained.

Reports suggest that the developers of Cthulhu Stealer may have ceased operations due to payment disputes and allegations of scamming their customers, resulting in the principal developer’s permanent ban from the cybercrime marketplace where the malware was promoted. Despite the apparent dissolution of the "Cthulhu Team," the threat to macOS devices remains.

To protect against such malware, it is advised that users follow these precautions: download software exclusively from trusted sources like the Apple App Store, enable macOS security features such as Gatekeeper, maintain up-to-date systems and applications with the latest security patches, and consider employing reputable antivirus solutions for added security.

By staying informed and implementing proactive measures, macOS users can significantly reduce their risk of malware infections and safeguard their systems. In the forthcoming macOS Sequoia, anticipated in mid-September, Apple plans to further restrict the installation of non-signed or non-notarized software.