“Cthulhu Stealer” Malware Targets MetaMask and Other Crypto Wallets on Apple Mac Devices

A new malware strain called “Cthulhu Stealer” targets Apple Mac users and can extract personal information as well as access many crypto wallets, including MetaMask.

The new malware appears as an Apple disk image and disguises itself as a legitimate application such as CleanMyMac and Adobe GenP.

Cthulhu Thief Asks Mac Users to Enter MetaMask Password

Mac users who open the malicious Apple disk image are first prompted to enter their system password. Then, a second prompt asks users to enter their system passphrase. MetaMask wallets.

Cthulhu Stealer also targets other popular wallets that can be installed on users’ devices. Wallets such as those from Coinbase, Wasabi, Electrum, BinanceBoth Atomic and Blockchain Wallet are at risk.

Information such as the device’s IP address and operating system are also extracted by the malware once it stores the stolen data in text files.

Similarities between new malware and atomic thief identified in 2023

Cybersecurity firm Cado Security drew comparisons between Cthulhu Stealer and a malware identified in 2023 called Atomic Stealer in a recent investigation. blog postBoth malware are designed to steal crypto wallet information, browser credentials, and keychain information.

“The functionality and features of Cthulhu Stealer are very similar to those of Atomic Stealer, indicating that the developer of Cthulhu Stealer likely took Atomic Stealer and modified the code,” a Cado Security researcher said in the blog post. Both malware even include the same spelling mistakes in their prompts, the researcher added.

Recently, Cado Security identified a malware-as-a-service (MaaS) targeting macOS users called “Cthulhu Stealer.” This blog will explore the capabilities of this malware and provide insight into how its operators conduct their activities:

— Cado (@CadoSecurity) August 22, 2024

Cthulhu Stealer is rented on Telegram to affiliates for $500 per month. The main developer of the malware also receives a percentage of the profits from each successful deployment.

However, the crooks behind the malware no longer appear to be active due to payment disputes that led to accusations of exit scam by affiliates.

Related articles:

PlayDoge (PLAY) – The Latest ICO on the BNB Chain

• Virtual Pet Dog 2D
• Play to win Meme Coin Fusion
• Staking and In-Game Token Rewards
• SolidProof Audit – playdoge.io