MITRE ATT&CKsoftware (malware)

S1153 Cuckoo Stealer

Published 2024-08-20 Modified 2024-10-28 Official page ↗
Domain
enterprise
Platforms
macOS
Version
1.0
Created
2024-08-20

Description

Cuckoo Stealer is a macOS malware with characteristics of spyware and an infostealer that has been in use since at least 2024. Cuckoo Stealer is a universal Mach-O binary that can run on Intel or ARM-based Macs and has been spread through trojanized versions of various potentially unwanted programs or PUP's such as converters, cleaners, and uninstallers.

Related

Uses · MITRE ATT&CK (26)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1027.008 Stripped Payloads sub-technique
  • T1647 Plist File Modification technique
  • T1614.001 System Language Discovery sub-technique
  • T1614 System Location Discovery technique
  • T1071.001 Web Protocols sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1569.001 Launchctl sub-technique
  • T1059.002 AppleScript sub-technique
  • T1059.004 Unix Shell sub-technique
  • T1564.001 Hidden Files and Directories sub-technique
  • T1555.001 Keychain sub-technique
  • T1056.002 GUI Input Capture sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1553.001 Gatekeeper Bypass sub-technique
  • T1543.001 Launch Agent sub-technique
  • T1518 Software Discovery technique
  • T1217 Browser Information Discovery technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1033 System Owner/User Discovery technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1095 Non-Application Layer Protocol technique
  • T1113 Screen Capture technique

References