Cthulhu Stealer is a macOS stealer written in Go that Cado Security described in August 2024; it was rented to criminals for $500 a month and disguised as disk images of CleanMyMac, Grand Theft Auto and Adobe GenP. If an app like that asked for your Mac password and then your MetaMask password, delete it, change your passwords and move your crypto from a device you trust.
Last reviewed · 1 source
Also known as: Cthulhu, CthulhuSteal
Cado Security (now part of Darktrace) found Cthulhu Stealer rented out by the 'Cthulhu Team' over Telegram for $500 a month, with affiliates paid a share for spreading it. It comes as a .dmg with builds for Intel and Apple silicon Macs and impersonates CleanMyMac, Grand Theft Auto IV (apparently meant to be VI) and Adobe GenP. Once opened, it uses osascript to ask for your Mac password and then your MetaMask password, saves what it collects in /Users/Shared/NW, dumps the Keychain with the open-source Chainbreaker tool, and steals credentials, crypto wallets and game accounts; Cado found it functionally similar to Atomic Stealer.
Fake disk images of CleanMyMac, Grand Theft Auto and Adobe GenP (Cado Security)
Cracked-software and 'free version' downloads from unofficial sites
Affiliates paid to spread it, so the lures vary
A password prompt right after opening a newly downloaded app
A second prompt asking for your MetaMask password
A folder named NW in /Users/Shared
Crypto balances dropping without transactions you made
Turn off Wi-Fi and Ethernet so nothing more is sent while you clean up.
Remove the fake app from /Applications, ~/Downloads and ~/Desktop, delete /Users/Shared/NW if it exists, and check ~/Library/Application Support for related folders.
Look in ~/Library/LaunchAgents and /Library/LaunchAgents for new plist files and remove ones you don't recognize.
From another device, change passwords starting with email, banking and crypto exchanges. It targets Keychain data and browser-stored credentials.
If you typed a MetaMask or wallet password into a prompt, move your assets to a new wallet on a device you trust and revoke token approvals.
CoreLock's free scan compares files in your Downloads folder against a built-in malware-hash list and 19 YARA rules and checks startup items. It can't confirm that every component is gone.
Don't download cracked or pirated software
Install apps from the Mac App Store or the developer's own site
Be suspicious of any app that asks for your Mac password right after opening
No app other than MetaMask itself needs your MetaMask password
What it can and can't do
Cthulhu Stealer comes as a disk image, so CoreLock's free Downloads check, which compares files against a built-in malware-hash list and 19 YARA rules, is the relevant one; a match is shown as worth a look and never quarantined on its own. It can't promise to catch every build.
Stealer — Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised...
Stealer — Banshee Stealer appeared in mid-2024 and was rented out for $3,000 a month throu...
Stealer — Realst is a macOS information stealer written in Rust. Security researcher iamde...
A macOS stealer written in Go and rented out for $500 a month. It poses as well-known software, asks for your Mac password and then your MetaMask password, and steals credentials, crypto wallets and game accounts.
It's cheap: Cado Security put it at $500 a month, against $1,000 a month for Atomic Stealer when Cyble reported it. Renting it to affiliates means more people spreading it through more lures.
It uses osascript, the built-in tool for running AppleScript, to show a password prompt that looks like it comes from macOS. A second prompt then asks for your MetaMask password.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser