New Cuckoo Malware Attacking macOS Users to Steal Data

Cybersecurity researchers have uncovered a new malware strain dubbed “Cuckoo.”

This malicious software exhibits characteristics of both spyware and an infostealer, targeting both Intel and ARM-based Macs with sophisticated tactics to extract sensitive information.

Discovery and Analysis

The malware, named after the brood parasitic bird known for laying its eggs in the nests of other birds, was first identified on April 24, 2024.

It was discovered within a Mach-O binary file masquerading as a legitimate application called DumpMediaSpotifyMusicConverter, which claims to convert music from Spotify to MP3 format.

Researchers from Kandji, a cybersecurity firm, discovered this malware after noticing unusual behavior in an application downloaded from the website dumpmedia[.]com.

Further investigation revealed that the malware is also hosted on similar websites like tunesolo[.]com, fonedog[.]com, tunesfun[.]com, and tunefab[.]com offer tools for ripping music from streaming services.

Upon examining the contents of the application bundle for “DumpMedia Spotify Music Converter,” researchers discovered a suspicious Mach-O binary named “upd” within the macOS folder.

Commonly, binaries within an application bundle are named after the application itself, making the name “upd” a significant red flag.

Further investigation revealed that this binary was signed ad hoc without a developer ID.

This lack of a registered developer ID means that macOS’s Gatekeeper security feature would initially block the application from running, requiring manual user intervention to override and allow execution

johnlocke@macos-14 ~ % codesign -dvvv /Volumes/DumpMedia Spotify Music Converter 3.1.29/DumpMedia Spotify Music Converter.app/Contents/MacOS/upd

Executable=/Volumes/DumpMedia Spotify Music Converter 3.1.29/DumpMedia Spotify Music Converter.app/Contents/MacOS/upd

Identifier=upd.upd

Format=app bundle with Mach-O universal (x86_64 arm64)

CodeDirectory v=20400 size=1536 flags=0x2(adhoc) hashes=38+7 location=embedded

Hash type=sha256 size=32

CandidateCDHash sha1=696343119e0a0686072f6a31d0edb29a5b8fd116

CandidateCDHashFull sha1=696343119e0a0686072f6a31d0edb29a5b8fd116

CandidateCDHash sha256=7a45639f768144799d608a4bbabf144fc1e3c016

CandidateCDHashFull sha256=7a45639f768144799d608a4bbabf144fc1e3c016a7d665775c6314a0c71540f1

Hash choices=sha1,sha256

CMSDigest=702fee1d3836cc14102ec2dfbf1e6706c2e359a8e38403d82789ba7d717cfc77

CMSDigestType=2

CDHash=7a45639f768144799d608a4bbabf144fc1e3c016

Signature=adhoc

Info.plist entries=24

TeamIdentifier=not set

Sealed Resources version=2 rules=13 files=242

Internal requirements count=0 size=12

Modus Operandi

Cuckoo is designed to perform a locale check to avoid infecting devices in certain regions:

• Armenia (hy_AM)
• Belarus (be_BY)
• Kazakhstan (kk_KZ)
• Russia (ru_RU)
• Ukraine (uk_UA)

If the check is passed, the malware proceeds with its malicious activities. It employs a fake application bundle to deceive users into downloading and running the malware.

On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free.

Once executed, it gains persistence on the host by installing a LaunchAgent, ensuring it remains active even after the system reboots.

The malware can execute commands to extract hardware information, capture currently running processes, and query for installed applications.

It can also take screenshots and harvest data from various sources, including iCloud Keychain, Apple Notes, web browsers, and cryptocurrency wallets.

Spying and Infostealing Capabilities

The Cuckoo’s primary function is to gather as much information as possible from the infected system.

It searches for files associated with specific applications and categorizes the collected data using a keyword observed in network communications.

This includes sensitive information such as passwords, system build info, hostnames, and usernames, which are then sent to a Command and Control server.

System profiler command to obtain hardware information: 

10001248c    __builtin_strcpy(dest: &systemProfilerCMD, src: "system_profiler SPHardwareDataTyt,")
100012498    XOR_func(&systemProfilerCMD, 0x23)
1000124a4    char* x0_14 = popenCMD(&systemProfilerCMD, 1)

Cuckoo employs various evasion tactics to maintain its presence on the infected machine discreetly.

It encrypts its network traffic and only executes its malicious components under specific conditions.

Additionally, it sets up a LaunchAgent to ensure it runs regularly, securing its foothold on the system.

Safety Measures

To protect against such threats, users must keep their software updated and patched, use reputable anti-malware tools, and avoid downloading applications from untrusted sources.

Regular scans with updated antivirus software can help detect and remove such malicious programs.

The discovery of the Cuckoo malware highlights the increasing sophistication of threats targeting macOS, a platform once considered relatively safe from such attacks.

This incident underscores the need for continuous vigilance and robust security measures to protect sensitive data from cybercriminals.

As the cybersecurity community continues to monitor and analyze this threat, users are urged to stay informed about the latest security practices and to implement recommended protective measures to safeguard their digital environments.

Indicators of Compromise

DMGS

• Spotify-music-converter.dmg: 254663d6f4968b220795e0742284f9a846f995ba66590d97562e8f19049ffd4b  

MACH-OS