How to remove Cthulhu from infected macOS
Written by Tomas Meskauskas on (updated)
What kind of malware is Cthulhu?
Cthulhu is an information stealer written in the the Go programming language and designed to appear as a legitimate application. Its primary purpose is to extract credentials and cryptocurrency wallets from various stores and game accounts. The stealer seems to be available for rent to individuals at a rate of $500 per month.
Cthulhu stealer overview
Once infiltrated, Cthulhu gathers system information, including macOS version, IP address, hardware and software information, and other details. The stealer saves the obtained information in a text file. As mentioned in the introduction, Cthulhu Stealer's primary function is to steal credentials and cryptocurrency wallets from a variety of online stores and game accounts.
More precisely, Cthulhu can steal browser (including Firefox) cookies, Telegram account information, Minecraft user information, SafeStorage passwords, Keychain passwords, Battlenet game, cache and log data. The targeted wallets include Atomic, Binance, Blockchain, Coinbase, Coinomi, Daedalus, Dapper, Electrum, Enjin, Harmony, Hoo, MetaMask, Trust, Wasabi, and XDeFI wallets.
Cybercriminals can use the information stolen by Cthulhu to cause various harm. With browser cookies and login credentials, they can steal online accounts, leading to identity theft, unauthorized transactions, and access to personal communications. Stolen passwords from SafeStorage and Keychain can be used to breach various accounts, such as email, banking, and social media.
The theft of cryptocurrency wallet information allows the attackers to drain funds, resulting in financial losses. Additionally, by accessing gaming accounts and platforms like Telegram, threat actors can further exploit or sell these accounts on the dark web. Thus, victims should remove Cthulhu as soon as possible to avoid potential harm.
| Name | Cthulhu information stealer |
| Threat Type | Information stealer, Mac malware, Mac virus |
| Detection Names | Avast (MacOS:Stealer-U [Trj]), Combo Cleaner (Gen:Variant.Trojan.MAC.Stealer.19), ESET-NOD32 (A Variant Of OSX/PSW.Agent.AK), Kaspersky (HEUR:Trojan-PSW.OSX.Cthulhu.a), Full List Of Detections (VirusTotal) |
| Symptoms | A program that you do not recall installing suddenly appeared on your computer. A new application is performing computer scans and displays warning messages about 'found issues'. Asks for payment to eliminate the supposedly found errors. |
| Distribution Methods | Fake DMG files for games and software (e.g., CleanMyMac, Grand Theft Auto IV, Adobe GenP), unofficial websites. |
| Damage | Monetary loss, identity theft, theft of personal accounts, slow computer performance, and more. |
| Malware Removal (Mac) | To eliminate possible malware infections, scan your Mac with legitimate antivirus software. Our security researchers recommend using Combo Cleaner. |
Conclusion
Cthulhu is a dangerous malware that targets various sensitive information, including login credentials, cryptocurrency wallets, and personal data. Its ability to infiltrate different platforms and steal sensitive data makes it a significant threat. Users should be careful online to protect their computers from such threats.
More examples of malware targeting macOS are Banshee Stealer, BeaverTail, and ROD Stealer.
How did Cthulhu infiltrate my computer?
Cthulhu is an Apple disk image (DMG) disguised as a disk image of CleanMyMac, Grand Theft Auto IV, Adobe GenP, and other legitimate software or games. Upon opening the file, the user is requested to enter their password. Once the user enters their password, a second prompt requests the user’s MetaMask password.
Once these steps are completed, Cthulhu checks the infected system for sensitive information and sends it to cybercriminals. It is important to note that fake DMG files are usually distributed via unofficial (often deceptive) websites, P2P networks, and similar channels.
How to avoid installation of malware?
Always download applications and files from reputable sources, such as official web pages and app stores. Avoid using other sources and downloading pirated software, key generators, cracking tools, etc. Do not open files and links in irrelevant emails sent from suspicious addresses. Do not interact with ads, pop-ups, banners, warnings, etc., on questionable websites.
Keep the operating system and all installed applications up to date, and scan your computer for threats regularly. If your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for macOS to automatically eliminate all threats.
Fake disk image (DMG) file containing Cthulhu (when opened):
Instant automatic Mac malware removal:
Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of Mac malware. Download it by clicking the button below:
▼ DOWNLOAD Combo Cleaner for Mac
By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by Rcs Lt, the parent company of PCRisk.com read more.
Quick menu:
Unwanted applications removal:
Remove potentially unwanted applications from your "Applications" folder:
Click the Finder icon. In the Finder window, select "Applications". In the applications folder, look for "MPlayerX","NicePlayer", or other suspicious applications and drag them to the Trash. After removing the potentially unwanted application(s) that cause online ads, scan your Mac for any remaining unwanted components.
Frequently Asked Questions (FAQ)
My computer is infected with Cthulhu malware, should I format my storage device to get rid of it?
Formatting your storage device can remove Cthulhu malware, but it will erase all your data. Thus, we recommend using tools like Combo Cleaner to detect and remove malware.
What are the biggest issues that malware can cause?
Cybercriminals can use malware to steal identities, money, personal accounts, infect computers with more malware, encrypt files, and more.
What is the purpose of Cthulhu?
This threat can steal login credentials, crypto wallets, Telegram data, data from gaming accounts, system information, and more.
How did Cthulhu infiltrate my computer?
It is known that the Cthulhu disk image file is disguised as an image file for games like GTA, software like CleanMyMac, Adobe GenP, and possibly other tools.
Will Combo Cleaner protect me from malware?
Yes, Combo Cleaner can detect and remove nearly all known malware infections. However, advanced malware often hides deeply within the system, so performing a full system scan is essential for detection and removal.
Outstanding!
▼ Show Discussion