Threat Research Knowledge Base Threats Cuckoo

Cuckoo

Description

Get a Free Trial

Variant Names

N/A

Alternative Names

N/A

Country of origin

Russia

Symptoms

You might observe the following artifacts associated with this threat:

Newly created launch agent typically used for persistence.
Unexpected prompts for system permissions or passwords.
Unfamiliar applications or processes.
Unusual network activity or data usage.

Technical Breakdown

Developed in Objective-C, Cuckoo has typically been seen running from a macho binary called upd. The upd binary was first seen being packaged with shovelware. Since then it has evolved into masquerading as macOS package managers such as Homebrew and Google Chrome.

Some of Cuckoos capabilities include:

Muting of system sounds
Dumping of the keychain database
Location check
Stealing browser passwords
Screen recording

Update (5/29/2026): Cuckoo Malware Evolves

Further communal investigation revealed Cuckoo evolution with domains hosted in Russia.

Next Steps

Kandji Endpoint Detection & Response (EDR) automatically removes detected threats when file monitoring is set to Protect.

While the malicious file is removed, it can leave behind artifacts that need to be cleaned manually.

In the future, avoid downloading and installing software from torrent sources or untrusted websites. Ensure that all applications are obtained from official and reputable sources to maintain system integrity and security.

Learn more about it

Cuckoo Behaves Like Cross Between Infostealer and Spyware

Cuckoo is an info stealer that typically masquerades as macOS applications such as Homebrew and Google Chrome. Discovered by Kandji in 2024, it has been known to steal passwords, as well as recording audio and video from an infected system. Cuckoo has been observed to evolve over time, with recent versions showing increased sophistication and capabilities.

Atomic Stealer (AMOS)

Atomic Stealer (AMOS) is a sophisticated piece of malware that targets Apple users by masquerading as legitimate applications. Once installed, AMOS can exfiltrate extensive data, including keychain passwords, user documents, system information, browser data, credit card information, and cryptocurrency wallets. There is a strong association between Atomic Stealer and Russian-speaking cybercriminal communities.

Backdoor Activator

Backdoor Activator is a macOS malware campaign that spreads through infected copies of popular applications and productivity tools, often via torrent downloads. Disguised as software 'Activators' to crack legitimate applications, this malware family compromises system security and may facilitate unauthorized remote access.

Banshee

Banshee is a sophisticated macOS infostealer that poses a significant threat to Apple users. It is designed to exfiltrate a wide range of sensitive information, including system data, login credentials, and, cryptocurrency wallets.

Manage and secure your Apple devices at scale.

Start Free Trial