Threat intelligence / Malware

Cuckoo Stealer

[Cuckoo Stealer](https://attack.mitre.org/software/S1153) is a macOS malware with characteristics of spyware and an infostealer that has been in use since at least 2024. [Cuckoo Stealer](https://attack.mitre.org/software/S1153) is a universal Mach-O binary that can run on Intel or ARM-based Macs and has been spread through trojanized versions of various potentially unwanted programs or PUP's such as converters, cleaners, and uninstallers.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Cuckoo Stealer](https://attack.mitre.org/software/S1153) is a macOS malware with characteristics of spyware and an infostealer that has been in use since at least 2024. [Cuckoo Stealer](https://attack.mitre.org/software/S1153) is a universal Mach-O binary that can run on Intel or ARM-based Macs and has been spread through trojanized versions of various potentially unwanted programs or PUP's such as converters, cleaners, and uninstallers.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024)

Labels

malware

26 recorded

Relationships

uses

Technique

uses

to Browser Information Discovery

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to File and Directory Discovery

Technique

uses

to Gatekeeper Bypass

Technique

uses

to GUI Input Capture

Technique

uses

to Hidden Files and Directories

Technique

uses

Technique

uses

to Launch Agent

Technique

uses

Technique

uses

to Local Data Staging

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Plist File Modification

Technique

uses

to Process Discovery

Technique

uses

to Screen Capture

Technique

uses

to Software Discovery

Technique

uses

to Stripped Payloads

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to System Location Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

Technique

uses

to Web Protocols

Technique

3 external

References

mitre-attack

S1153

Kandji Cuckoo April 2024

https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware

SentinelOne Cuckoo Stealer May 2024

https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/