Ethereum

Zeitgeist

Apple

Security

Apple Mac users are being warned about a new strain of malware called “Cthulhu Stealer,” which can steal their personal information and target crypto wallets.&nbsp;
“For years, there has been a general belief in the Zeitgeist that macOS systems are immune to malware,” <a data-ct-non-breakable="null" href="https://www.cadosecurity.com/blog/from-the-depths-analyzing-the-cthulhu-stealer-malware-for-macos" rel="noopener noreferrer nofollow" target="null" text="null">said</a> cybersecurity firm Cado Security on Aug. 22.&nbsp;
<blockquote>
 “While MacOS has a reputation for being secure, macOS malware has been trending up in recent years.”
</blockquote>
“Cthulhu Stealer” appears as an Apple disk image (DMG) and disguises itself as legitimate software like CleanMyMac and Adobe GenP.
When users open the file, the macOS command-line tool for running AppleScript and JavaScript is used to <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/8-most-common-cyberattacks-and-how-to-prevent-them" rel="noopener noreferrer nofollow" target="null" text="null">prompt</a> them for their password.&nbsp;
Once this is entered, a second prompt will appear for the password to the popular Ethereum wallet, MetaMask. It also targets other popular <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/the-history-and-evolution-of-cryptocurrency-wallets" rel="noopener noreferrer nofollow" target="null" text="null">crypto wallets</a>, including those from Coinbase, Wasabi, Electrum, <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/crypto-atomic-wallet-faces-class-action-over-100m-crypto-hack-losses" rel="noopener noreferrer nofollow" target="null" text="null">Atomic</a>, Binance, and Blockchain Wallet.
The <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/what-is-crypto-malware-and-how-to-detect-it" rel="noopener noreferrer nofollow" target="null" text="null">malware</a> stores the stolen data in text files before fingerprinting the victim’s system to gather data such as IP address and operating system version.&nbsp;
<figure><img alt="Mac users warned over malware ‘Cthulhu’ that steals crypto wallets" name="" src="https://s3.cointelegraph.com/uploads/2024-08/01918cb0-a693-7e87-96bc-5ccafa7ac614">
 <figcaption style="text-align: center;">
 Cthulhu Stealer ‘checking’ for installed crypto wallets. Source: Cado Security
 </figcaption>
</figure>
“The main functionality of Cthulhu Stealer is to steal credentials and cryptocurrency wallets from various stores, including game accounts,” explained Cado researcher Tara Gould.
Cthulhu Stealer is very similar to Atomic Stealer, malware that was identified in 2023 targeting Apple computers. This indicates that the developer of Cthulhu Stealer “probably took Atomic Stealer and modified the code,” added Gould.
The malware was being rented out to affiliates for $500 per month using the Telegram messaging platform, with the main developer sharing profits from successful deployments.
However, the scammers behind the malware are said to be no longer active, following disputes over payments that have led to accusations of an exit scam by affiliates.
On Aug. 23, Cointelegraph <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/mac-amos-malware-clones-wallet-crypto" rel="noopener noreferrer nofollow" target="null" text="null">reported</a> that the AMOS malware, which also targets Mac users, can now clone Ledger Live software.&nbsp;
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/mac-amos-malware-clones-wallet-crypto" rel="noopener noreferrer nofollow" target="null" text="null">Mac users beware: AMOS malware clones wallet apps and comes for your crypto</a>
Apple has recently acknowledged the increasing threat of malware targeting its operating systems. On Aug. 6, the tech giant <a data-ct-non-breakable="null" href="https://developer.apple.com/news/?id=saqachfa" rel="noopener noreferrer nofollow" target="null" text="null">announced</a> an update to its next-generation macOS version that makes it a little more difficult for users to override Gatekeeper protections that ensure only trusted applications are allowed to run on the system.&nbsp;
In May, Telegram <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/telegram-camera-exploit-apple-macos-security-permissions" rel="noopener noreferrer nofollow" target="null" text="null">played down</a> the severity of an exploit that allowed researchers to gain access to macOS camera systems, stating that it had more to do with Apple’s permission security than the messaging platform.&nbsp;
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/algorithm-choice-can-fix-social-media-but-only-on-decentralized-platforms/" rel="noopener noreferrer nofollow" target="null" text="null">Jack Dorsey’s ‘marketplace of algorithms’ could fix social media… so why hasn’t it?</a>

Mac users warned over malware ‘Cthulhu’ that steals crypto wallets

Cointelegraph

Other articles published on Aug 26, 2024

Telegram Facing Removal From Apple After Allegations On CEO Pavel Durov?

Thailand Cracks Down on Illegal Bitcoin Mine After Power Outages

9-Year Dormant Ethereum Address Moves 2,000 ETH: What You Need to Know

Crypto investment products saw largest inflows in five weeks, CoinShares says

Unveiled: Mexico’s Secret Plan to Ditch the Dollar for Bitcoin!

India amasses 5M central bank digital currency users

Join our free newsletter for daily crypto updates!