OopsSec: The Short Lived Campaign of Cthulhu Stealer

The talk examines Cthulhu Stealer, a macOS information stealer sold as a service and active from 2023 into early 2024. The speaker places it within rising Mac malware detections and a shift from adware toward stealers, then recounts how a suspicious sample turned up during a casual search. The malware arrives in a disk image, impersonates popular software, and tricks users into typing their system password into a fake prompt. That password unlocks keychain data, while browser data, wallets, messaging and gaming credentials, and system details are gathered and sent to a command server.

The central story is the operator's mistakes. The binary was not stripped and held a hardcoded MongoDB Atlas admin connection string, giving access to a database of builds and victim records. Usernames from that data led to public Telegram channels and marketplace posts tied to the group's admin. Arbitration threads showed affiliates complaining of unpaid earnings from early 2024, which the speaker assessed as an exit scam, after which the malware stopped being updated and the campaign ended.

The lessons are that criminals scam each other and make ordinary developer errors that can expose their identities. Researchers should examine every artifact, including infrastructure, because such slips can be exploited. The talk also reminds defenders that Macs are not immune.