en
Cthulhu macOS StealerCthulhu Stealer (also known as Cthulhu macOS Stealer) is an information-stealing malware family. Cthulhu Stealer targets browser credentials, cryptocurrency wallets, Telegram session tokens, macOS Keychain entries and System inventory and hardware fingerprint. As of 11/10/2026, CyStack's research records 1 variant, with high attribution confidence.
Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes
Original English
Cthulhu Stealer is a Go-written macOS infostealer that
exfiltrates a custom Userinfo.txt written to
/Users/Shared/NW/. The body opens with IP: and Country:
fields and continues with macOS hardware and account inventory.
Observed in @bugatti_cloud aggregator packs.
Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.
1 variant recorded for this malware
| ID | Data collected | Confidence |
|---|---|---|
1e1c870... | 5,450 | High |
To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence
MetaMask Info:Debanks: <value>BuildID:<value> Userinfo:Country: <value>IP: <value>City: <value>Software: System Software Overview: System Version: <value> Kernel Version: <value> Boot Volume: <value> Boot Mode: <value> Computer Name: <value> User Name: <value> Secure Virtual Memory: <value> System Integrity Protection: <value> Time since boot: <value> Hardware: Hardware Overview: Model Name: <value> Model Identifier: <value> Model Number: <value> Chip: <value> Total Number of Cores: <value> Memory: <value> System Firmware Version: <value> OS Loader Version: <value> Serial Number (system): <value> Hardware UUID: <value> Provisioning UDID: <value> Activation Lock Status: <value> Graphics/Displays: Apple M2: Chipset Model: <value> Type: <value> Bus: <value> Total Number of Cores: <value> Vendor: <value> Metal Support: <value> Displays:Color LCD: Display Type: <value> Resolution: <value> Main Display: <value> Mirror: <value> Online: <value> Automatically Adjust Brightness: <value> Connection Type: <value>LEN P27h-10: Resolution: <value> UI Looks like: <value> Mirror: <value> Online: <value> Rotation: <value>
