The latest malware is reportedly a variation of previously reported crypto-stealing software
A new form of malware targeting Apple Mac users has emerged, creating a significant threat to cryptocurrency wallets. Known as “Cthulhu Stealer,” this malicious software is designed to steal sensitive personal information and access crypto wallets. The malware disguises itself as legitimate software, such as CleanMyMac or Adobe GenP, and is distributed through Apple disk image (DMG) files.
When users open these files, they encounter a prompt asking for their system password. After entering this password, they are prompted again for their cryptocurrency wallet password, including those used for MetaMask, Coinbase, Wasabi, Electrum, Atomic, Binance, and Blockchain Wallet. Once the passwords are entered, Cthulhu Stealer stores the stolen data in text files and gathers additional information about the victim’s system, including IP address and operating system version.
Cado Security, a cybersecurity firm, highlighted this threat on August 22, noting that while macOS has long been considered secure, there has been a rise in malware targeting the operating system in recent years. Cthulhu Stealer bears a close resemblance to another malware called Atomic Stealer, which was identified in 2023, suggesting that the developers of Cthulhu Stealer may have modified the existing code.
The malware was reportedly available for rent through the Telegram messaging platform at a rate of $500 per month. However, disputes over payments have led to allegations of an exit scam by the affiliates involved in spreading the malware.
In response to increasing threats, Apple has acknowledged the growing problem and recently updated its macOS to enhance security. The update aims to make it more challenging for users to bypass Gatekeeper protections, which are designed to ensure only trusted applications can run on the system. This new development follows earlier reports of malware such as AMOS, which can clone Ledger Live software, further underscoring the rising risks for Mac users.
