Loading story…
Threat researchers reported a renewed surge of Odyssey Stealer activity targeting macOS, with infections spreading rapidly across multiple regions. The malware is typically delivered via social engineering—masquerading as legitimate software updates, fake apps, or cracked tools—and is designed to steal high-value data including cryptocurrency wallets, browser-stored credentials (e.g., Chrome and Safari), personal documents, and items stored in the macOS Keychain. Moonlock Lab telemetry described a sharp increase in detections and a fast-expanding geographic footprint, consistent with a coordinated campaign and improved stealth/evasion techniques.
In parallel, analysis of Apple’s built-in malware defenses noted an unusual XProtect update (version 5327) that significantly expanded a newer YARA ruleset file, XPScripts.yr, focused on detecting malicious OSAScript (including AppleScript) content at execution time via the Open Scripting framework. The update increased OSAScript-focused rules from 2 to 14, reflecting growing abuse of lightweight, script-driven infection chains in recent macOS stealer campaigns (including AMOS/SOMA), where victims are coached into running obfuscated Terminal commands and downloading payloads (e.g., via curl) to avoid quarantine controls. Together, the reporting indicates escalating macOS infostealer pressure and corresponding defensive tuning by Apple to better detect script-based tradecraft used to bootstrap these infections.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A new wave of Odyssey stealer activity targeting macOS users was publicly reported, aligning with broader observations of rapidly evolving infostealer campaigns against Apple systems.
Apple updated XProtect to version 5327, significantly revising XPScripts.yr and expanding its ruleset from 2 to 14 to better detect malicious OSAScript/AppleScript used in evolving macOS stealer campaigns.
By early 2026, AMOS/SOMA and related Odyssey-style macOS stealer activity was increasingly delivered through poisoned search results and other lures that tricked users into running obfuscated Terminal commands instead of relying on traditional exploit chains.
Apple added a newer Yara-based component, XPScripts.yr, to XProtect with version 5322, initially containing two rules to inspect OSAScript/AppleScript content for malicious behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are escalating **macOS infostealer** activity through multiple distribution and evasion techniques aimed at harvesting sensitive user data. One campaign abuses trust in legitimate AI platforms by promoting shareable *ChatGPT* and *Grok* conversation links via **Google Ads**, luring users searching for common macOS troubleshooting help into running malicious Terminal commands using the **“ClickFix”** social-engineering pattern. Executing the provided shell commands results in installation of **Atomic macOS Stealer (AMOS)**, which steals browser credentials, crypto wallet seed phrases, **Keychain** data, and personal files before exfiltrating them to attacker-controlled infrastructure. Separately, **Odyssey Stealer** intrusions against macOS have surged globally, with notable targeting reported in the U.S., France, and Spain and additional impact across Europe, the Americas, and parts of Asia and Africa. Moonlock Lab reporting indicates Odyssey is delivered through **fake software updates, cracked tools, and fraudulent apps**, and is designed to evade detection by generating a **unique fingerprint per infection**, frequently changing code structure, and using many distinct **SHA-256** variants—suggesting automated builders are being used to produce large numbers of hard-to-block samples. Collectively, the reporting highlights sustained pressure on macOS users from credential-stealing malware that blends high-trust lures with rapid variant generation to hinder traditional defenses.
Jun 29, 2026
Threat actors are increasingly targeting macOS users with **infostealers** and distribution-as-a-service models, reflecting a broader “gold rush” in Apple-focused malware development. Reporting highlights macOS stealers targeting browser credentials and cryptocurrency assets (including seed phrases) and notes tactics to evade Apple controls such as obtaining valid Apple developer signatures to bypass *Gatekeeper*; one cited example is *MacSync* being notarized and signed under Team ID `GNJLS3UYZ4`. The same reporting describes ecosystem-scale enablement, including large-scale compromise of WordPress sites for distribution and novel command-and-control approaches such as using blockchain smart contracts (e.g., on **BNB Smart Chain**), alongside paid-traffic abuse (e.g., promoting malicious AI chat content via ads) to push stealer payloads. Separately, a Darktrace-described investigation details a **multi-stage macOS malware** campaign that prioritizes *social engineering* over exploitation to defeat Apple’s **Transparency, Consent, and Control (TCC)** privacy framework. Victims are lured via phishing to open an AppleScript masquerading as a document (`Confirmation_Token_Vesting.docx.scpt`), which displays a fake “Compatibility” error and instructs the user to launch a “Compatibility Wizard” (e.g., using a keyboard shortcut) that effectively tricks them into authorizing execution and granting access. Together, the reporting indicates macOS threats are increasingly succeeding by combining credential/crypto theft objectives with user-prompt manipulation and trust-abuse techniques rather than relying on kernel or sandbox escapes.
Jun 29, 2026
Microsoft reported that **information-stealing malware activity is expanding from Windows to macOS**, driven by campaigns observed since late 2025 that rely on social engineering and cross-platform tooling. The activity includes **ClickFix-style prompts** and **malicious DMG installers** that deliver macOS-focused infostealer families such as **Atomic macOS Stealer (AMOS)**, **MacSync**, and **DigitStealer**, with operators leveraging **fileless execution**, **native macOS utilities**, and **AppleScript automation** to evade defenses and automate collection. Initial access commonly starts with **malicious search ads (e.g., Google Ads)** that redirect users to fake sites impersonating legitimate tools and then trick victims into running “fix” steps or installing trojanized software. The malware is assessed to target high-value data including browser credentials and session cookies, **iCloud Keychain** contents, crypto wallet data, and **developer secrets**; Microsoft also highlighted growing use of **Python-based stealers** distributed via phishing for rapid adaptation across heterogeneous environments, citing **PXA Stealer** (linked to Vietnamese-speaking actors) as an example used in late-2025 campaigns with persistence mechanisms such as registry `Run` keys or scheduled tasks and **Telegram** used for command-and-control.
Jun 29, 2026