Cthulhu Stealer: A Go-Built macOS Stealer That Exit-Scammed Its Own Affiliates

Cthulhu Stealer is a macOS infostealer malware-as-a-service written in Go, analysed by Cado Security in August 2024. It ships as a universal DMG disguised as cracked or popular apps, uses fake osascript prompts to capture the login and MetaMask passwords, and dumps the Keychain. Cado assessed it as a modified Atomic Stealer derivative. The operation collapsed after an alleged exit scam against affiliates got its operator banned.

Overview

Cthulhu was rented to individuals at roughly $500 per month, with the developer reportedly paying affiliates a cut based on deployments, under the operator handles “Cthulhu” and “Balaclavv.” Cado assessed that the developer took Atomic Stealer and modified it, noting shared osascript prompts and even identical misspellings. The operator was reportedly later banned from a forum after affiliates alleged unpaid earnings.

How It Works

• Prompts the user for the system password via osascript, then a second prompt for a MetaMask password. T1059.002 T1056.002
• Dumps Keychain passwords using a “Chainbreak” routine, writing output to Keychain.txt. T1555.001
• Steals browser-stored credentials, cryptocurrency wallets, FileZilla configuration files, Telegram data and MetaMask. T1555.003 T1552.001
• Stages collected data in a zip under /Users/Shared/NW/ and notifies the C2. T1074.001 T1041

Delivery

Cthulhu was delivered as an Apple DMG with both Intel and Apple Silicon binaries, disguised as cracked or popular software — reported examples include CleanMyMac, GTA IV and Adobe GenP. After the user mounts and opens it, the fake-password social-engineering chain runs. T1036

MITRE ATT&CK Mapping

Detection & Mitigation

• Monitor for the /Users/Shared/NW/ staging directory and a Keychain.txt file.
• Alert on osascript password dialogs shortly after a DMG mount, and on Chainbreak-style Keychain access.
• Avoid cracked and pirated software — the primary lure — and enforce Gatekeeper and notarization. Leaked or forked builds may persist despite the operator’s apparent shutdown.