Loading malware…
Odyssey Stealer is a macOS information-stealing malware family with persistent remote-access capabilities, operated through an affiliate-based malware-as-a-service model. It is a rebrand of Poseidon Stealer, which originated as a fork of Atomic macOS Stealer (AMOS). Campaigns target individuals and corporate Mac users worldwide, particularly cryptocurrency users. Samples support both Apple silicon and Intel architectures.
Distribution relies heavily on social engineering, including ClickFix prompts, fake CAPTCHA verification, deceptive software updates, cracked tools, and trojanized application installers. Impersonated products and services include Homebrew, TradingView, CleanShot, and ChatGPT. Malicious advertising and counterfeit download pages direct victims to installers or persuade them to execute obfuscated shell commands in Terminal, which retrieve and run AppleScript payloads.
Odyssey displays fraudulent macOS authentication prompts and validates captured passwords using native system utilities. It steals macOS Keychain data, browser passwords, payment and autofill information, browsing history, session cookies, authentication tokens, cryptocurrency private keys and seed phrases, and sensitive documents. Collection also encompasses wallet extensions and desktop wallets, Apple Notes, messaging applications, SSH keys, and cloud and developer credentials. Stolen cookies support session hijacking. Collected information is archived and uploaded to attacker-controlled infrastructure, with retry logic for failed transfers.
Beyond data theft, Odyssey can replace Ledger, Trezor, and Exodus applications with trojanized versions intended to intercept wallet secrets or facilitate cryptocurrency theft. It establishes persistence through LaunchDaemons and supports remote shell execution, reinfection, and SOCKS5 proxying through compromised hosts. Anti-sandbox checks help it avoid analysis environments. Its centralized management panel provides payload building, compromised-device management, and stolen-data access segregated by affiliate. The operation is associated with a Russian-speaking cybercriminal ecosystem; a definitive state-sponsored attribution is not established.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Odyssey, in essence, is a sophisticated variation or updated iteration of the original Poseidon, designed to operate in the post-Gatekeeper bypass era.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
The sheet was a Google Apps Script web app. The Windows delivery was a signed Microsoft ClickOnce application named GapiUpdate.application.
The site then instructs macOS users to copy and paste a Base64-encoded command into their terminal.
In most scenarios, once users interact with the Fix or Verify button in the lure, the button will covertly copy an obfuscated PowerShell command to the clipboard and present the user with “verification steps.”
Odyssey Stealer brought with it a host of enhanced capabilities designed specifically to evade detection... These new features included: Anti-sandboxing mechanisms: Tools and logic to detect and avoid execution within analysis environments like virtual machines or emulators.
On macOS, this exact trap drops Odyssey Stealer to steal sensitive data.
A kártevő a fertőzött rendszerekről képes lehet a böngészőkben tárolt jelszavak, aktív munkamenet cookie-k és automatikus kitöltési adatok megszerzésére
A kártevő a fertőzött rendszerekről képes lehet a böngészőkben tárolt jelszavak... megszerzésére... A kártevő emellett célba veszi a macOS Keychain tartalmát
Containing the username, password keychain, hardware details, and other browser-related information.
The researchers found that Odyssey can collect passwords, cookies, and autofill data from widely used browsers...
Odyssey Stealer brought with it a host of enhanced capabilities designed specifically to evade detection... These new features included: Anti-sandboxing mechanisms: Tools and logic to detect and avoid execution within analysis environments like virtual machines or emulators.
Once launched, the malware quietly searches the device for valuable information... By taking wallet data, cloud and developer credentials, messaging-app information, and local system records...
107 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a comparison for browser-cookie theft that can expose accounts without revealing passwords. No operational relationship with GhostProfile is established.
macOS information-stealing malware discussed in connection with C2 infrastructure, cryptocurrency-wallet replacement, and malicious DMG delivery artifacts.
macOS stealer delivered by the alternate macOS infection chain in the same campaign.
A macOS information-stealing malware that collects credentials, browser data, cryptocurrency wallet data, cloud and developer credentials, messaging-app information, SSH keys, shell history, and other sensitive files. It also establishes persistence via a LaunchDaemon, communicates with command-and-control infrastructure, and has been observed replacing wallet applications with trojanized versions to drain cryptocurrency wallets.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.