New Mac Malware “Cuckoo” Exposes Vulnerabilities in Apple Devices

Researchers at Kandji have unearthed a formidable new threat targeting Mac users, dubbed “Cuckoo.” This malware, discovered within applications offered on a website known as “DumpMedia,” is designed to covertly perform actions such as taking screenshots of users’ screens without their knowledge, revealing a significant security vulnerability in Apple’s devices.

The malicious application was found in a seemingly innocent software package called “DumpMedia Spotify Music Converter,” which is marketed as a tool to convert songs from streaming services into MP3 files. However, the installation process for these apps is unusual; users are prompted to right-click and select “Open” instead of dragging the application into the Applications folder, a method that cleverly bypasses some of Apple’s built-in security measures.

Upon further investigation, Kandji researchers opted to inspect the package contents rather than follow the suspicious installation instructions. Their scrutiny revealed not only the expected application bundle but also an unverified executable file lacking a developer ID, which would typically trigger Apple’s Gatekeeper security feature to block the app.

When executed, the software starts harvesting information about the computer and initiates a series of processes. Notably, it halts operations if it detects that the system is located in Armenia, Belarus, Kazakhstan, Russia, or Ukraine. The malware cleverly prompts the user to enter their system password under the guise of needing access to System Settings, then verifies the password and continues to access various system areas, including the Finder, Downloads, and the microphone.

Moreover, it scrapes data from the Safari browser, such as bookmarks, cookies, and history, as well as from applications like Notes and Keychain, where passwords are stored. One of the most invasive features of “Cuckoo” is its ability to take screenshots silently—muting the speakers momentarily to avoid alerting the user.

This discovery underscores the importance of vigilance when downloading software directly from the internet. Users are advised to download apps from reputable sources, preferably directly from the developers or through approved app stores, and to be wary of any installation process that deviates from the norm. Always allow Apple’s security features to function as intended and heed any warnings about application installations.

The revelation of “Cuckoo” is a stark reminder that no system, not even Macs, which have long been touted for their robust security, is immune to the ever-evolving landscape of cyber threats.