Cybersecurity Researchers at Kandji have discovered a Mach-O binary malware built to infect both Intel and ARM-based MacOS systems. Cuckoo is being distributed by websites that claim to provide applications designed to rip music from streaming services into MP3 format. The malicious binary is named “upd” and is not signed with a developer ID, which means victims would need to ignore MacOS’s Gatekeeper security warning to allow execution. Once the malware is allowed to run, it performs a locale check to ensure the infected device is not in Armenia, Belarus, Kazakhstan, Russia, or the Ukraine and then installs LaunchAgent for persistence. This is a technique seen in many previous MacOS malware families. Cuckoo is designed to steal as much information from the victim machine as possible. The malware also leverages osascript to display fake password prompts to trick victims into entering system password information. Cuckoo is capable of taking screenshots and harvesting data from iCloud Keychain, web browsers, cryptocurrency wallets, and applications such as Telegram and Discord. Stolen data is sent back to the attackers’ Command-and-Control (C2) server. This new malware variant serves as a reminder that MacOS systems are not impervious to attacks and that defenders should equip MacOS assets with appropriate security tooling such as next-gen antivirus. In addition, end users should vet software or applications prior to downloading, and organizations should maintain guardrails around end users’ capability to download executables from the internet. CTIX analysts will continue to report on emerging and evolving strains of malware and associated campaigns.