Kandji Cuckoo April 2024

Cuckoo Stealer is a stripped binary payload.

Cuckoo Stealer strings are XOR-encrypted.

Cuckoo Stealer can discover and send the username from a compromised host to C2.

Cuckoo Stealer has copied and renamed itself to DumpMediaSpotifyMusicConverter.

Cuckoo Stealer can send information about the targeted system to C2 including captured passwords, OS build, hostname, and username.

Cuckoo Stealer has captured passwords by prompting victims with a “macOS needs to access System Settings” GUI window.

Cuckoo Stealer can use `ps aux` to enumerate running processes.

Cuckoo Stealer can use osascript to generate a password-stealing prompt, duplicate files and folders, and set environmental variables.

Cuckoo Stealer can spawn a bash shell to enable execution on compromised hosts.

Cuckoo Stealer can use the curl API for C2 communications.

Cuckoo Stealer has staged collected application data from Safari, Notes, and Keychain to `/var/folder`.

Cuckoo Stealer can gather information about the OS version and hardware on compromised hosts.

Cuckoo Stealer can search for files associated with specific applications.

Cuckoo Stealer can use sockets for communications to its C2 server.

Cuckoo Stealer can run `screencapture` to collect screenshots from compromised hosts.

Cuckoo Stealer strings are deobfuscated prior to execution.

Cuckoo Stealer can collect bookmarks, cookies, and history from Safari.

Cuckoo Stealer has the ability to search systems for installed applications.

Cuckoo Stealer can achieve persistence by creating launch agents to repeatedly execute malicious payloads.

Cuckoo Stealer can use `xattr -d com.apple.quarantine` to remove the quarantine flag attribute.

Cuckoo Stealer can capture files from a targeted user's keychain directory.

Cuckoo Stealer has copied its binary and the victim's scraped password into a hidden folder in the `/Users` directory.

Cuckoo Stealer can use `launchctl` to load a LaunchAgent for persistence.

Cuckoo Stealer can determine the geographical location of a victim host by checking the language.

Cuckoo Stealer can check the systems `LANG` environmental variable to prevent infecting devices from Armenia (`hy_AM`), Belarus (`be_BY`), Kazakhstan (`kk_KZ`), Russia (`ru_RU`), and Ukraine (`uk_UA`).

Cuckoo Stealer can create and populate property list (plist) files to enable execution.