New Cthulhu Stealer malware targets macOS crypto wallets

A new malware-as-a-service (MaaS) known as “Cthulhu Stealer” has emerged, targeting macOS users and stealing cryptocurrency from popular wallets like MetaMask and Binance.

This discovery by Cado Security highlights a significant security threat, challenging the perception that macOS systems are immune to malware attacks.

Cthulhu Stealer disguises itself as legitimate software, such as CleanMyMac, Adobe GenP, and even a supposed early release of “Grand Theft Auto VI.”

Once users mount the malicious disk image file, they are prompted to enter their system and MetaMask passwords, initiating the malware’s attack.

The malware uses the macOS tool osascript to access and extract passwords stored in the system’s Keychain.

This information, including credentials for various crypto wallets and other sensitive data, is compiled into a zip archive named with the user’s country code and the attack’s timestamp.

In addition to stealing crypto wallet information, Cthulhu Stealer targets a range of other data, including browser extension wallets, game data, and various types of encrypted passwords.

It also collects detailed system information like IP address, system name, and OS version, sending this data to a command and control (C2) server used by the attackers to refine their operations.

The malware is being rented out to criminals for $500 per month.

The Cthulhu Team, responsible for this malware, manages its operations through Telegram and sells it on well-known malware marketplaces.

Scammers often disguise themselves as employers offering job opportunities that require the download of malicious software.

To protect against such threats, users are advised to install reputable antivirus software specifically designed for macOS and to be cautious with job offers requiring immediate software downloads.

Regular software updates can also help mitigate the risk of infection.