A new malware threat called “Cuckoo” has been discovered by cybersecurity researchers at Kandji, targeting macOS users. Disguised as a music converter application similar to Spotify, Cuckoo poses a significant security risk to Apple Mac computers running on both Intel and ARM-based processors.

The malware was first detected when a malicious Mach-O binary was found on April 24, 2024, masquerading as the legitimate application “DumpMedia Spotify Music Converter.” It has since been identified on various websites offering both free and paid versions of the supposed music converter.

Cuckoo employs deceptive tactics to lure users, claiming to convert Spotify music to MP3 format. Once installed, it initiates a data theft operation, targeting sensitive information stored on macOS systems. This includes passwords stored in the keychain, browsing history, messaging app data, cryptocurrency wallet details, and authentication credentials.

The malware is capable of self-installation without proper vetting, requesting users to open an app without a verified signature or developer ID. It also leverages user prompts to gain access to additional system resources such as the Finder, microphone, and downloads folder.

Key targets of Cuckoo include the macOS keychain, which stores critical login credentials and cryptographic keys, as well as messaging apps like WhatsApp and Telegram. By compromising these platforms, the malware can access sensitive user data and pose a significant financial threat, especially to cryptocurrency owners.

Researchers have not explicitly attributed the Cuckoo campaign to any specific threat actor, but they have observed patterns suggesting geographic targeting, with devices in certain regions being spared from infection.

To protect against Cuckoo and similar malware threats, users are advised to exercise caution when downloading software, avoid untrusted sources, scrutinize email attachments, and utilize reliable antivirus and anti-malware solutions. Maintaining vigilance and skepticism in the digital realm is crucial for safeguarding personal privacy and security against evolving cyber threats.