Cthulhu Malware Stealer for macOS

Cado Security (now part of Darktrace) analysed “Cthulhu Stealer,” a macOS malware-as-a-service written in Go that impersonates legitimate software and prompts for user and MetaMask passwords to steal credentials, cryptocurrency wallets, and game accounts. The malware is distributed as a DMG with two binaries and uses osascript to prompt for a password, then stores stolen data in /Users/Shared/NW and dumps Keychain passwords via Chainbreaker, ultimately creating a ZIP of the gathered data.

It collects system information, IP details from ipinfo[.]io, and targets multiple stores such as MetaMask, various crypto wallets, Battlenet, and Ethereum-related assets. Cthulhu Stealer is advertised as MaaS and was rented via an underground marketplace; operators faced complaints in 2024 and were permanently banned for alleged exit scamming, with the main developer advertising in late 2023.

The tool’s functionality closely mirrors Atomic Stealer, including the use of osascript and similar credential-collection techniques. The blog describing these findings was published on 22 August 2024. according to Cado Security (now part of Darktrace).