'Cthulhu Stealer' macOS Malware Can Steal Keychain Passwords, Web Browsing Info, Crypto Wallets, and More

Apple's Macs are less targeted by malware than Windows PCs, but that doesn't mean they are immune. Increasingly, insidious types of Mac malware are being developed that have researchers concerned enough to issue public warnings, and that's the case again today.

macos cthulu stealer malware
As reported by Hacker News, Cado Security has identified a malware-as-a-service (MaaS) targeting macOS users named "Cthulhu Stealer." First spotted in late 2023, the malicious software is designed to steal sensitive information from infected Macs, such as saved passwords from iCloud Keychain, information from web browsers, and even details from Telegram accounts.

What's particularly concerning is that it's being sold as a service on the dark web for $500 per month, potentially allowing multiple bad actors to use it against unsuspecting Mac owners.

Cato Security researcher Tara Gould reports that Cthulhu Stealer disguises itself as popular software to trick users into installing it. It might appear as CleanMyMac, Grand Theft Auto IV, or even Adobe GenP (a tool some users employ to bypass Adobe's subscription model). The malware comes packaged as a disk image (DMG) file.

If a user tries to open the fake app, macOS's built-in security feature, Gatekeeper, warns that the software is unsigned. But if a user chooses to bypass this warning, the malware immediately asks for the user's system password, mimicking a legitimate system prompt. This technique isn't new – other Mac malware like Atomic Stealer and MacStealer use similar tricks.

Once it has the necessary permissions, Cthulhu Stealer can access and steal a wide range of sensitive data. For crypto users, it specifically targets MetaMask digital wallet information. All of this stolen data is then sent to the attackers' servers.

Notably, reports suggest that whoever designed Cthulu Stealer is no longer active, apparently following disputes over payments and accusations of scamming their own customers, i.e. other cybercriminals who were using the malware.

While Cthulhu Stealer isn't the most sophisticated malware out there, it's still a significant threat to Mac users who might be tricked into installing it. General security pointers include only downloading software from trusted sources like the App Store or official developer websites, being wary of any app asking for your system password during installation, and keeping your Mac updated with the latest security patches from Apple.

In macOS Sequoia, expected to be released in mid-September, Apple plans to remove the ability to easily override Gatekeeper warnings by Control-clicking. Instead, users will need to go through System Settings to allow unsigned software to run, adding an extra step that might make users think twice before running potentially dangerous apps.

Tag: Malware

Popular Stories

Generic iOS 19 Feature Mock Light

iOS 19 Will Bring Biggest Design Overhaul Since iOS 7

Monday March 10, 2025 12:17 pm PDT by
Apple is planning for a major design overhaul of the iPhone, iPad, and Mac interfaces with the introduction of iOS 19, iPadOS 19, and macOS 16 later this year, reports Bloomberg. The update will "fundamentally change" the look of Apple's operating system, introducing a more consistent cross-platform experience. Apple plans to update the style of icons, menus, apps, windows, and system...
ios 18 4 carplay

Apple Upgrades CarPlay in Two Ways

Wednesday March 12, 2025 6:05 am PDT by
The upcoming iOS 18.4 update for the iPhone includes a smaller but meaningful improvement for Apple's in-car iPhone mirroring system CarPlay. Specifically, CarPlay now shows a third row of icons, up from two rows previously. However, this change is only visible in vehicles with a larger center display. For example, a MacRumors Forums member noticed the change in a Toyota Tundra with a...
Apple One Apps Feature 2

Apple One's Best Plan Now Includes Two More Perks For Free

Monday March 10, 2025 6:40 am PDT by
Apple One allows you to subscribe to up to six Apple services for one discounted monthly price. There are three Apple One tiers: Individual, Family, and Premier. Over the last month, the highest-end ‌Apple One‌ Premier plan has gained two additional perks. Here is what Apple One Premier already included, for $37.95 per month:Apple Music Apple TV+ Apple Arcade Apple News+ Apple Fitness+...
airpods pro 2 gradient

AirPods Pro 3 Launch Now Just Months Away: Here's What We Know

Tuesday March 11, 2025 3:26 am PDT by
Despite being released over two years ago, Apple's AirPods Pro 2 continue to dominate the wireless earbud market. However, with the AirPods Pro 3 expected to launch in 2025, anyone thinking of buying Apple's premium earbuds may be wondering if the next generation is worth holding out for. Apart from their audio and noise-canceling performance, which are generally regarded as excellent for...
iOS 18

12 New Things Your iPhone Can Do in iOS 18.4

Monday March 10, 2025 9:28 am PDT by
Apple is set to release iOS 18.4 in early April, bringing further refinements to Apple Intelligence features, a neat new capability to iPhone 15 Pro devices, new emoji, and more. While not quite as packed with new features as Apple's preceding iOS 18 point releases, iOS 18.4 still introduces enhancements that aim to make your iPhone smarter and more intuitive. Below, we've listed 12 new...
iphone 17 mockups idevicehelp

Video Shows iPhone 17 Mockups Based on 'Internal Documents'

Monday March 10, 2025 4:41 am PDT by
YouTuber iDeviceHelp on Friday posted a video that shows off mockups of Apple's forthcoming iPhone 17 models that are purportedly based on "internal documents." We're sharing the video here since it was made in collaboration with leaker Majin Bu, who last month published similar iPhone 17 renders that were widely corroborated by separate leakers with links to Apple's Chinese supply chain....
iOS 18

iOS 18.3.2 Update Coming Soon for iPhones

Monday March 10, 2025 7:25 am PDT by
Apple employees are internally testing iOS 18.3.2 for iPhones, according to our website's visitor logs, which have been a reliable indicator of upcoming iOS versions. The software update should be released in the next week or two. iOS 18.3.2 will be a minor update that addresses software bugs and/or security vulnerabilities. Don't expect any new features. iOS 18.3.2 will be an interim...
iOS 18

Apple Releases iOS 18.3.2 With Bug Fixes

Tuesday March 11, 2025 10:33 am PDT by
Apple today released iOS 18.3.2 and iPadOS 18.3.2, minor updates for the iOS 18 and iPadOS 18 operating systems that came out last September. iOS 18.3.2 and iOS 18.3.2 come a month after Apple released iOS 18.3.1 and iPadOS 18.3.1. The new software can be downloaded on eligible iPhones and iPads over-the-air by going to Settings > General > Software Update. According to Apple's release...
Apple Maps vs Google Maps Feature

iOS 18.4 Adds a Highly-Requested Setting to iPhones — But Not in U.S.

Wednesday March 12, 2025 1:05 pm PDT by
iPhones are finally getting a much-requested setting, but availability is limited. The upcoming iOS 18.4 update introduces an option to set a default navigation app, other than Apple Maps, but unfortunately this new setting is limited to users in the EU. There, you can now set an app like Google Maps or Waze as your default navigation app on the iPhone by opening the Settings app and tapping ...

Top Rated Comments

roar08 Avatar
7 months ago

It might appear as CleanMyMac, Grand Theft Auto IV, or even Adobe GenP (a tool some users employ to bypass Adobe's subscription model). The malware comes packaged as a disk image (DMG) file.
In other words, it might appear as the software you're pirating.
Score: 48 Votes (Like | Disagree)
Darth Tulhu Avatar
7 months ago
Walled gardens exist FOR A REASON.
Score: 31 Votes (Like | Disagree)
sw1tcher Avatar
7 months ago

As reported by Hacker News ('https://thehackernews.com/2024/08/new-macos-malware-cthulhu-stealer.html'), Cado Security has identified a malware-as-a-service (MaaS) targeting macOS users named "Cthulhu Stealer."
My name isn't Cthulhu Stealer so I should be safe, right?
Score: 30 Votes (Like | Disagree)
WarmWinterHat Avatar
7 months ago

Walled gardens exist FOR A REASON.
They do, to make Apple money.
Score: 25 Votes (Like | Disagree)
wonderings Avatar
7 months ago
So if you don't pirate software you are good, makes sense.
Score: 20 Votes (Like | Disagree)
Darth Tulhu Avatar
7 months ago

They do, to make Apple money.
Security guards get paid, don't they?
Score: 19 Votes (Like | Disagree)