Cuckoo is a 2024 macOS stealer with spyware features that Kandji found inside free music-converter apps, such as DumpMedia's Spotify converter, offered by sites that turn streaming music into MP3s. If you installed one of those converters, delete it, remove its LaunchAgent, and turn off any microphone or Automation access you gave it in Privacy & Security.
Last reviewed · 2 sources
Also known as: Cuckoo Spyware, OSX.Cuckoo
Kandji found Cuckoo in 2024 in a universal app named DumpMediaSpotifyMusicConverter, then in converters from tunesolo, fonedog, tunesfun and tunefab, all offering to convert streaming music to MP3. It asks for your password with a fake prompt reading 'macOS needs to access System Settings', asks for access to Finder, the microphone and Downloads, installs a LaunchAgent so it runs at login, mutes the Mac's volume, takes screenshots, and copies Safari, Notes and Keychain data. MITRE ATT&CK tracks it as Cuckoo Stealer.
Music converters for Spotify and Apple Music from DumpMedia, TuneSolo, FoneDog, TunesFun and TuneFab (Kandji)
Universal apps that run on both Intel and Apple silicon Macs
A fake 'macOS needs to access System Settings' password prompt during setup
You installed a music converter or streaming ripper from one of those sites
A converter asked for your Mac password, then for access to Finder, the microphone or Downloads
Your Mac's volume muted itself after opening the app
A new item in ~/Library/LaunchAgents from around the time you installed it
Delete the converter app from /Applications and check ~/Library/Application Support for a folder with its name.
In System Settings › Privacy & Security, check Microphone, Automation and Files & Folders, and turn off access for the converter and anything else you don't trust.
Look in ~/Library/LaunchAgents for a plist added when you installed the converter and delete it.
Cuckoo copies Keychain and Safari data, so change important passwords from another device and turn on two-factor authentication.
CoreLock's free scan checks startup items. With Full Disk Access, its Privacy report lists which apps macOS has granted the microphone, camera, Screen Recording, Accessibility, Full Disk Access and Input Monitoring.
Avoid unofficial tools for ripping or converting streaming music
Check which apps can use your microphone in System Settings from time to time
Don't give a new app your password just because it asks for 'System Settings' access
Get apps from the Mac App Store or the developer's own site
What it can and can't do
Cuckoo persists with a LaunchAgent, which CoreLock's free startup-items check covers, and it asks for microphone access: with Full Disk Access, CoreLock's free Privacy report lists the apps macOS has granted the microphone, camera, Screen Recording, Accessibility, Full Disk Access and Input Monitoring. A grant isn't proof an app recorded anything, and CoreLock can't promise to catch every variant.
Stealer — Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised...
Stealer — Banshee Stealer appeared in mid-2024 and was rented out for $3,000 a month throu...
Stealer — Uptycs found MacStealer advertised on the dark web in March 2023, sold as builds...
Through music-converter apps for Spotify and Apple Music. Kandji first found it in DumpMedia's Spotify converter and then in similar apps from TuneSolo, FoneDog, TunesFun and TuneFab.
It asks for microphone access, along with Finder and Downloads, after phishing your password, and it takes screenshots. macOS shows an orange dot in the menu bar while an app is using the microphone. CoreLock's menu bar panel also shows which app is using the camera or microphone; it doesn't record or block either.
Many stealers grab data and leave. Cuckoo installs a LaunchAgent so it keeps running at every login, takes screenshots and copies Safari, Notes and Keychain data, which is why Kandji described it as part stealer, part spyware.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser