Auto

Apple

Security

Coin

As the valuation of digital assets continues to experience growth, the cryptocurrency domain encounters a proliferation of security-related threats and vulnerabilities. 
A recent development in this arena is the emergence of “Cthulhu Stealer,” which represents a particularly advanced iteration of malware-as-a-service (MaaS) that has successfully penetrated macOS systems. 
As Cado Security&nbsp;<a href="https://www.cadosecurity.com/blog/from-the-depths-analyzing-the-cthulhu-stealer-malware-for-macos" target="_blank" rel="noreferrer noopener">informed</a>&nbsp;readers, Cthulhu Stealer is specifically engineered to compromise macOS platforms to exfiltrate critical cryptocurrency-related data. 
<figure class="wp-block-image size-large">
 <img loading="lazy" decoding="async" width="1024" height="908" src="https://www.thecoinrepublic.com/wp-content/uploads/2024/08/image-433-1024x908.png" alt="Source:&nbsp;Cado Security" class="wp-image-681157" srcset="https://www.thecoinrepublic.com/wp-content/uploads/2024/08/image-433-1024x908.png 1024w, https://www.thecoinrepublic.com/wp-content/uploads/2024/08/image-433-300x266.png 300w, https://www.thecoinrepublic.com/wp-content/uploads/2024/08/image-433-768x681.png 768w, https://www.thecoinrepublic.com/wp-content/uploads/2024/08/image-433-1536x1362.png 1536w, https://www.thecoinrepublic.com/wp-content/uploads/2024/08/image-433-150x133.png 150w, https://www.thecoinrepublic.com/wp-content/uploads/2024/08/image-433-696x617.png 696w, https://www.thecoinrepublic.com/wp-content/uploads/2024/08/image-433-1068x947.png 1068w, https://www.thecoinrepublic.com/wp-content/uploads/2024/08/image-433-1920x1702.png 1920w, https://www.thecoinrepublic.com/wp-content/uploads/2024/08/image-433.png 2000w" sizes="(max-width: 1024px) 100vw, 1024px">
 <figcaption class="wp-element-caption">
 Source:&nbsp;<a href="https://www.cadosecurity.com/blog/from-the-depths-analyzing-the-cthulhu-stealer-malware-for-macos">Cado Security</a>
 </figcaption>
</figure> 
Cthulhu Stealer doesn’t come barging in; it sneaks in under the guise of legitimate software. It masquerades as popular applications like CleanMyMac or Adobe GenP. It can even come up as a supposed early release of “Grand Theft Auto VI.” 
Users are lured into mounting a malicious DMG file. Once opened, the malware prompts for system and MetaMask passwords, initiating a series of malicious activities. 
The malware employs macOS’s own osascript tool to siphon passwords stored in the system’s Keychain. This includes sensitive data from crypto wallets such as MetaMask, Coinbase, and Binance. 
The stolen credentials are then packaged into a zip file, which is organized by the victim’s country and attack time, enabling attackers to target their efforts more effectively. 
Cthulhu Stealer’s reach extends far beyond just cryptocurrency wallets. It captures: 
<ul class="wp-block-list"> 
 <li>Crypto Wallets: Wasabi, Daedalus, Electrum, Atomic, Harmony, Enjin, Hoo, Dapper, Coinomi, Trust, Blockchain, XDeFi</li> 
 <li>Browser Extensions: Chrome extension wallets</li> 
 <li>Gaming Accounts: Minecraft, Battlenet</li> 
 <li>Miscellaneous Data: Firefox cookies, Telegram Tdata</li> 
</ul> 
Additionally, it collects detailed system information, including IP addresses and OS versions. This data is sent to a command and control (C2) server, allowing attackers to refine their tactics and expand their reach. 
<h2 class="wp-block-heading" id="h-how-cthulhu-stealer-steals-your-wallet-info">How Cthulhu Stealer Steals Your Wallet Info</h2> 
Here’s where it gets unsettling: Cthulhu Stealer isn’t just a tool—it’s a business. Scammers are leasing out this malware for $500 a month. The Cthulhu Team, as the developers are known, profits by renting the malware to affiliates, who then deploy it and earn a portion of the rental fees. 
The malware is sold on various malware marketplaces and managed via Telegram, making it easily accessible to those with malicious intent. 
<h2 class="wp-block-heading" id="h-protecting-yourself-from-cthulhu-stealer">Protecting Yourself from Cthulhu Stealer</h2> 
In light of this new threat, here’s how you can protect yourself: 
<ol class="wp-block-list"> 
 <li>Install Antivirus Software: Ensure your antivirus is up-to-date and specifically designed for macOS.</li> 
 <li>Be Wary of Unverified Downloads: Avoid downloading software from unknown sources, especially if linked to urgent or suspicious job offers.</li> 
 <li>Regular Software Updates: Keep your macOS and applications updated to defend against potential vulnerabilities.</li> 
</ol> 
Cthulhu Stealer closely resembles Atomic Stealer, a malware discovered in 2023, suggesting that its creator might have adapted the same code with some tweaks. This malware is being rented out for $500 a month via Telegram, with earnings divided among its affiliates. 
Apple has recently acknowledged the rising&nbsp;<a href="https://www.thecoinrepublic.com/2023/09/01/russian-origin-malware-infamous-chisel-cryptocurrency-threat/">threat of malware</a>&nbsp;affecting its operating systems. On August 6, the company announced an update for the next macOS version that tightens Gatekeeper protections, making it harder for users to bypass security measures and ensure that only trusted apps can run on their systems. 
Back in May,&nbsp;<a href="https://www.thecoinrepublic.com/2023/10/06/telegram-on-its-way-to-embrace-web3-with-tons-8-figure-funding/">Telegram</a>&nbsp;downplayed concerns about an exploit that let researchers access macOS camera systems, suggesting that the issue was more about Apple’s permission settings rather than flaws within the messaging app itself. 
The post <a href="https://www.thecoinrepublic.com/2024/08/26/how-cthulhu-stealer-targets-macos-users-and-steals-crypto/">How “Cthulhu Stealer” Targets macOS Users and Steals Crypto</a> appeared first on <a href="https://www.thecoinrepublic.com">The Coin Republic</a>.

How “Cthulhu Stealer” Targets macOS Users and Steals Crypto

Table of Contents

Thecoinrepublic.com

Other articles published on Aug 26, 2024

Will Crypto Recover: Analyzing Market Trends and Economic Indicators

Is Cardano Price Expected to Hit $1 Again?

Bitcoin ETFs Surges with $252M Inflows, Ethereum ETFs Lagging: Will ETH Bounce Back?

Weekly Article Recap: 8/12-8/16

3 Toncoin Rivals Poised to 2x Due to Pavel Durov’s Arrest

Slash Vision Labs Token (SVL) to be Listed on Gate.io as it Prepares Slash Card Launch

Join our free newsletter for daily crypto updates!