Harmony

Auto

Discord

<a href="https://bitcoinworld.co.in/new-malware-cthulhu-stealer-steals-crypto-from-metamask-binance-and-other-wallets-on-macos/" title="New Malware, Cthulhu Stealer, Steals Crypto From MetaMask, Binance, And Other Wallets On macOS" rel="nofollow"></a>
<ul> 
 <li style="font-weight: 400">Cthulhu Stealer, a new malware, targets macOS, stealing crypto from wallets like MetaMask and Binance.</li> 
 <li style="font-weight: 400">Disguised as legitimate apps, it tricks users into entering passwords, accessing Keychain, and stealing data.</li> 
 <li style="font-weight: 400">Scammers charge $500/month for this malware, promoting it via Telegram and targeting users with fake job offers.</li> 
</ul> 
Cado Security’s discovery has thoroughly debunked the <a href="https://www.cadosecurity.com/blog/from-the-depths-analyzing-the-cthulhu-stealer-malware-for-macos" target="_blank" rel="noopener">belief</a> that macOS systems are impervious to malware. This revelation concerns a new malware-as-a-service (MaaS) called “Cthulhu Stealer,” which targets macOS users through deceptive means. 
The rise of Cthulhu Stealer indicates that no system is completely secure against cyber threats. 
<h3 id="span-style-font-weight-400-how-cthulhu-stealer-malware-steals-mac-users-crypto-span">How “Cthulhu Stealer,” Malware Steals Mac Users’ Crypto?</h3> 
Cthulhu Stealer disguises itself as legitimate applications such as CleanMyMac and Adobe GenP and software claiming to be an early release of “Grand Theft Auto VI.” 
<figure id="attachment_80259" aria-describedby="caption-attachment-80259" style="width: 100%" class="wp-caption aligncenter">
 <img decoding="async" class=" wp-image-80259" src="http://bitcoinworld.co.in/wp-content/uploads/Screenshot-of-Cthulhu-Stealer-400x300.webp" alt="" width="505" height="379" srcset="https://bitcoinworld.co.in/wp-content/uploads/Screenshot-of-Cthulhu-Stealer-400x300.webp 400w, https://bitcoinworld.co.in/wp-content/uploads/Screenshot-of-Cthulhu-Stealer-667x500.webp 667w, https://bitcoinworld.co.in/wp-content/uploads/Screenshot-of-Cthulhu-Stealer-800x600.webp 800w, https://bitcoinworld.co.in/wp-content/uploads/Screenshot-of-Cthulhu-Stealer-768x576.webp 768w, https://bitcoinworld.co.in/wp-content/uploads/Screenshot-of-Cthulhu-Stealer.webp 1024w" sizes="(max-width: 505px) 100vw, 505px">
 <figcaption id="caption-attachment-80259" class="wp-caption-text">
 Screenshot of Cthulhu Stealer
 </figcaption>
</figure> 
&nbsp; 
Once the user mounts the malicious DMG file, they are prompted to enter the system and MetaMask passwords. This initial deception is just the beginning. 
Following the credentials input, the malware utilizes osascript, a macOS tool, to extract passwords from the system’s Keychain.&nbsp; 
This data, including details from crypto wallets like MetaMask, Coinbase, and Binance, is compiled into a zip archive. This archive, identified by the user’s country code and the time of the attack, contains the stolen information. 
Cthulhu Stealer also steals data from other platforms, including: 
<ul> 
 <li style="font-weight: 400">Chrome extension wallets</li> 
 <li style="font-weight: 400">Minecraft user information</li> 
 <li style="font-weight: 400">Wasabi wallet</li> 
 <li style="font-weight: 400">Keychain passwords</li> 
 <li style="font-weight: 400">SafeStorage passwords</li> 
 <li style="font-weight: 400">Battlenet game, cache, and log data</li> 
 <li style="font-weight: 400">Firefox cookies</li> 
 <li style="font-weight: 400">Daedalus wallet</li> 
 <li style="font-weight: 400">Electrum wallet</li> 
 <li style="font-weight: 400">Atomic wallet</li> 
 <li style="font-weight: 400">Harmony wallet</li> 
 <li style="font-weight: 400">Electrum wallet</li> 
 <li style="font-weight: 400">Enjin wallet</li> 
 <li style="font-weight: 400">Hoo wallet</li> 
 <li style="font-weight: 400">Dapper wallet</li> 
 <li style="font-weight: 400">Coinomi wallet</li> 
 <li style="font-weight: 400">Trust wallet</li> 
 <li style="font-weight: 400">Blockchain wallet</li> 
 <li style="font-weight: 400">XDeFi wallet</li> 
 <li style="font-weight: 400">Browser cookies</li> 
 <li style="font-weight: 400">Telegram Tdata account information</li> 
</ul> 
Moreover, Cthulhu Stealer collects detailed system information such as IP address, system name, and OS version. It then sends this data to a command and control (C2) server, enabling the attackers to refine their strategies. 
Scammers use various strategies to trap the victims into installing the malware. For example, on social media, some scammers pose as employers who offer jobs that require downloading software to track working hours.&nbsp; 
These offers come with a sense of urgency, pushing the potential victim to download the application quickly. 
<figure id="attachment_80258" aria-describedby="caption-attachment-80258" style="width: 100%" class="wp-caption aligncenter">
 <img loading="lazy" decoding="async" class=" wp-image-80258" src="http://bitcoinworld.co.in/wp-content/uploads/Screenshots-of-Scammer-Trying-to-Trap-Victim-Into-Installing-Malicious-Software-182x300.jpg" alt="" width="338" height="557" srcset="https://bitcoinworld.co.in/wp-content/uploads/Screenshots-of-Scammer-Trying-to-Trap-Victim-Into-Installing-Malicious-Software-182x300.jpg 182w, https://bitcoinworld.co.in/wp-content/uploads/Screenshots-of-Scammer-Trying-to-Trap-Victim-Into-Installing-Malicious-Software-303x500.jpg 303w, https://bitcoinworld.co.in/wp-content/uploads/Screenshots-of-Scammer-Trying-to-Trap-Victim-Into-Installing-Malicious-Software-364x600.jpg 364w, https://bitcoinworld.co.in/wp-content/uploads/Screenshots-of-Scammer-Trying-to-Trap-Victim-Into-Installing-Malicious-Software-768x1267.jpg 768w, https://bitcoinworld.co.in/wp-content/uploads/Screenshots-of-Scammer-Trying-to-Trap-Victim-Into-Installing-Malicious-Software-931x1536.jpg 931w, https://bitcoinworld.co.in/wp-content/uploads/Screenshots-of-Scammer-Trying-to-Trap-Victim-Into-Installing-Malicious-Software-1241x2048.jpg 1241w, https://bitcoinworld.co.in/wp-content/uploads/Screenshots-of-Scammer-Trying-to-Trap-Victim-Into-Installing-Malicious-Software.jpg 1289w" sizes="(max-width: 338px) 100vw, 338px">
 <figcaption id="caption-attachment-80258" class="wp-caption-text">
 Screenshots of Scammer Trying to Trap Victim Into Installing Malicious Software
 </figcaption>
</figure> 
<h3 id="span-style-font-weight-400-scammers-charge-500-per-month-for-cthulhu-stealer-span">Scammers Charge $500 Per Month For Cthulhu Stealer</h3> 
The developers and affiliates behind Cthulhu Stealer, known as the Cthulhu Team, use Telegram to manage their operations. 
“The stealer appears to be being rented out to individuals for $500/month, with the main developer paying out a percentage of earnings to affiliates based on their deployment. Each affiliate of the stealer is responsible for the deployment of the malware. Cado has found Cthulhu stealer sold on two well-known malware marketplaces which are used for communication, arbitration and advertising of the stealer, along with Telegram,” Cado informed readers. 
To protect themselves, users should install reputable antivirus software that is specifically designed for macOS.&nbsp; 
They should also be cautious of employment opportunities that require immediate software downloads. Regular software updates can further reduce the risk of malware infections.

New Malware, Cthulhu Stealer, Steals Crypto From MetaMask, Binance, And Other Wallets On macOS

Table of Contents

ItsBitcoinWorld

Other articles published on Aug 26, 2024

Binance and CZ Face Lawsuit in Seattle Federal Court Over Alleged Money Laundering Practices

Sony Unveils Ethereum Layer-2 Blockchain 'Soneium' to Accelerate Web3 Adoption

SEC Files Complaint Against Abra for Unregistered Securities Sales

Slash Vision Labs Token (SVL) to be Listed on Gate.io as it Prepares Slash Card Launch

BabyDogeCoin Launches Petition to Secure Binance Listing

What's the Latest Situation in Bitcoin? Is the Direction Clear for the Price? QCP Analysts Share ...

Join our free newsletter for daily crypto updates!