Your passwords and personal data are being targeted by this cunning malware.

Recently, there has been a rise in malware attacks on macOS, despite historically lower rates of hacking on Apple Macs compared to Windows devices.

A new threat called "Cthulhu Stealer" has emerged, which impersonates popular apps to harvest passwords and steal data from macOS users, according to security researchers.

As cybercriminals continue to create malware for Apple's operating system, the perception of Macs being inherently more secure is changing. Although Macs still face fewer threats overall compared to Windows PCs, the difference is becoming smaller.

How this ‘malware-as-a-service’ targets your Mac

Since late 2023, Cthulhu Stealer malware has been accessible through a malware-as-a-service (MaaS) model for $500 a month, as discovered by Cado Security.

"Tara Gould, a Cado Security researcher, stated that Cthulhu Stealer is an Apple disk image (DMG) that contains two binaries based on the architecture. The malware, written in Golang, is designed to appear as legitimate software."

The malware poses as legitimate software, imitating programs such as CleanMyMac, Grand Theft Auto IV, and Adobe GenP, which is an open-source tool used to bypass Adobe's Creative Cloud service and activate apps without payment.

If you install a malicious app disguised as a legitimate one on your Mac, you will receive a warning from macOS that the app is not trustworthy. Disregarding the warning and proceeding will prompt you to enter your password. Following that, you will be asked to provide your MetaMask password. The malware will then create a directory in ‘/Users/Shared/NW’ and save the credentials in text files. The Keychain passwords will be dumped using Chainbreak and saved in a file called Keychain.txt.

With the necessary permissions granted, Cthulhu Stealer can obtain a vast array of confidential information, including iCloud Keychain passwords, web browser cookies, and Telegram account details.

Cthulhu Stealer's primary function is to pilfer credentials and cryptocurrency wallets from multiple stores, including game accounts, as Gould elucidated.

Hackers are preying on Mac users

Recently, Cisco Talos researchers discovered a vulnerability in Microsoft apps that could allow hackers to steal all your data and gain control of your system.

A malware called Banshee is stealing passwords, cryptocurrency, and personal data from over 100 browsers on Mac devices. Along with the numerous data breaches this year, this serves as a reminder to take cybersecurity seriously.

5 tips to protect yourself from Mac malware

To protect your Mac from the latest malware threats, including Cthulhu Stealer, follow these essential tips.

To safeguard yourself from malicious links, malware, phishing emails, and ransomware scams, it is essential to have antivirus software installed on all your devices. For the best 2024 antivirus protection winners for your Windows, Mac, Android, and iOS devices, get my picks.

Be cautious when downloading software: Only download from reputable sources such as the Mac App Store or official developer websites. Avoid unsolicited emails or messages that prompt you to download or install updates, especially if they contain links. Be wary of phishing attempts that disguise themselves as legitimate update notifications or urgent messages.

To stay protected from vulnerabilities, make sure that both macOS and all installed applications are up to date. Apple frequently releases security patches and updates. To simplify the process, enable automatic updates for macOS and your apps. For more guidance, refer to my guide on keeping all your devices updated.

To safeguard your Mac from malware, it is imperative to employ strong and distinctive passwords for all your accounts and gadgets. It is advisable to steer clear of reusing passwords across multiple websites or platforms. A password manager can be an invaluable tool in this regard. It can generate and store intricate passwords on your behalf, rendering them virtually impregnable to hackers.

A password manager securely stores all your login credentials in one place, eliminating the need to remember them. This reduces the likelihood of reusing passwords, thereby lowering the risk of security breaches. For more information on the top-rated password managers of 2024, click here.

Enable two-factor authentication (2FA) for your crucial accounts, such as your Apple ID, email, and financial services. This additional layer of security makes it more challenging for attackers to access your accounts even if they obtain your password.

Kurt’s key takeaway

While Macs were once considered safe from hackers, recent threats like Cthulhu Stealer and Banshee have shown that they are not immune. These malware can steal passwords, data, and even cryptocurrency, so it's crucial to invest in strong antivirus software and exercise caution when downloading anything online.

How do you decide if it's safe to install new software when downloading it? Do you trust app store ratings, reviews, or something else? Share your thoughts with us at Cyberguy.com/Contact.

To receive my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter at Cyberguy.com/Newsletter.

Follow Kurt on his social channels

Answers to the most asked CyberGuy questions:

New from Kurt:

Copyright 2024 CyberGuy.com.  All rights reserved.