Odyssey
Odyssey is a macOS information stealer and malware-as-a-service (MaaS) offering. The reporting describes it as a rebrand and successor of Poseidon Stealer, which itself forked from Atomic macOS Stealer (AMOS). It is part of the broader AMOS/Poseidon/Odyssey macOS stealer family and is consistently associated with theft of browser cookies, saved credentials, authentication tokens, cryptocurrency wallet data, and other user information.
Observed delivery methods are heavily social-engineering driven. Odyssey has been distributed through weaponized DMG installers disguised as legitimate software, including fake branded installers that instruct users to bypass Gatekeeper protections. It has also been delivered through ClickFix-style phishing pages impersonating brands such as TradingView, Microsoft Teams, and Spectrum, where victims are tricked into copying and executing malicious commands in Terminal or via osascript. Reported hosting and lure domains tied to Odyssey campaigns include teamsonsoft[.]com, tradingview.connect-app[.]us[.]com, treadingveew.dekstop-apps[.]com, treadingveew.last-desk[.]org, claudflurer[.]com, emailreddit[.]com, cloudlare-lndex[.]com, and tradingviewen[.]com.
Functionally, Odyssey steals data from Safari, Chromium-based browsers, and Gecko-based browsers. Reported collected artifacts include Cookies.binarycookies, Form Values, Cookies, Web Data, Login Data, Local Extension Settings, IndexedDB data, cookies.sqlite, formhistory.sqlite, key4.db, and logins.json. It specifically targets MetaMask by locating and copying its IndexedDB storage. It also steals Apple Notes data, login keychains, and local passwords, including use of dscl . authonly to validate the local password and a fake prompt reading "Required Application Helper. Please enter device password to continue." to capture credentials. In one documented campaign it attempted to retrieve the Chrome keychain item and stored captured passwords in ~/.pwd.
Odyssey also targets cryptocurrency users extensively. Reporting states it recursively copies data from desktop wallets including Electrum, Coinomi, Exodus, Atomic, Wasabi, Monero, Bitcoin Core, Litecoin Core, Dash Core, Electron Cash, Guarda, Dogecoin Core, Trezor Suite, and Ledger Live, and also collects Binance and TonKeeper configuration paths. In the CloudSEK-tracked campaign, stolen data was mirrored into temporary directories, archived to /tmp/out.zip using ditto -c -k, and exfiltrated via HTTP POST to http://185.93.89.62/log with custom headers including username: vipx and repeat: false.
Persistence and follow-on behavior have also been documented. Odyssey established persistence by installing a randomly named com.<random>.plist LaunchDaemon under /Library/LaunchDaemons/ and invoking launchctl bootstrap system. The same campaign replaced /Applications/Ledger Live.app with a trojanized version downloaded from C2 infrastructure. Additional reported Odyssey C2 or related infrastructure includes 45.146.130[.]129 and 185.93.89[.]62.
Research into Odyssey operator infrastructure identified live administration panels on 86.54.25[.]202 and 86.54.25[.]204 hosted on a Kazakhstan subnet associated with AS210006 (GOODTEC). One panel was itself backdoored by another threat actor via injected JavaScript that intercepted POST requests to /api/v1/sign-in and exfiltrated operator cookies and credentials to scan-tron[.]link on 107.189.23[.]185. Analysis of a clean panel exposed 29 Odyssey API routes and showed functionality for bot management, AppleScript payload building, stolen log management, SOCKS proxy management, Telegram and FTP exfiltration settings, guest access, admin controls, seed phrase handling, and an /api/v1/admin/safe-exit emergency teardown capability. The panel code also referenced vash-server[.]com as a default server configuration placeholder.
High-confidence indicators mentioned in the reporting include: 185.93.89.62, 45.146.130[.]129, 86.54.25[.]202, 86.54.25[.]204, scan-tron[.]link, vash-server[.]com, teamsonsoft[.]com, and the SHA-256 hashes 95c17869073bff8a045083315c97583cb0d4f4c19165e657ed584ef7e16868a1 (backdoored Odyssey panel bundle) and 6c0c64c2da550ecab6eb9b855afe2833fde8f928a37168b7e4527665a9a7ae47 (clean Odyssey panel bundle).
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
Execution
4 techniques
Execution
LaunchDaemon persistence: downloads a shell command string, wraps it in a random-named com.<random>.plist, installs to /Library/LaunchDaemons/, launchctl bootstrap system ...; falls back to nohup run if bootstrap fails. Requires sudo, hence the password prompt earlier. (T1543.004, T1053.003)
One-liner launches a large embedded AppleScript with osascript -e 'run script ...'. No exploit, just script execution. (T1059.002)
Persistence
5 techniques
Persistence
LaunchDaemon persistence: downloads a shell command string, wraps it in a random-named com.<random>.plist, installs to /Library/LaunchDaemons/, launchctl bootstrap system ...; falls back to nohup run if bootstrap fails. Requires sudo, hence the password prompt earlier. (T1543.004, T1053.003)
LaunchDaemon persistence: downloads a shell command string, wraps it in a random-named com.<random>.plist, installs to /Library/LaunchDaemons/, launchctl bootstrap system ...; falls back to nohup run if bootstrap fails. Requires sudo, hence the password prompt earlier. (T1543.004, T1053.003)
Privilege Escalation
4 techniques
Privilege Escalation
LaunchDaemon persistence: downloads a shell command string, wraps it in a random-named com.<random>.plist, installs to /Library/LaunchDaemons/, launchctl bootstrap system ...; falls back to nohup run if bootstrap fails. Requires sudo, hence the password prompt earlier. (T1543.004, T1053.003)
LaunchDaemon persistence: downloads a shell command string, wraps it in a random-named com.<random>.plist, installs to /Library/LaunchDaemons/, launchctl bootstrap system ...; falls back to nohup run if bootstrap fails. Requires sudo, hence the password prompt earlier. (T1543.004, T1053.003)
Stealth
3 techniques
Stealth
Defense Impairment
1 technique
Defense Impairment
Credential Access
9 techniques
Credential Access
Checks if it can auth the local user with dscl . authonly. If not, it prompts the user with a fake dialog: “Required Application Helper. Please enter device password to continue.” It loops until the correct password is entered. (T1056.002, T1110)
When the wrapper sees a POST request to /api/v1/sign-in, it extracts username and password from the request body Sends both to https://scan-tron[.]link/l?d=
Checks if it can auth the local user with dscl . authonly. If not, it prompts the user with a fake dialog: “Required Application Helper. Please enter device password to continue.” It loops until the correct password is entered. (T1056.002, T1110)
Credentials, browser cookies, authentication tokens, and crypto wallets are all fair game.
Stashes the captured password at ~/.pwd. (T1555, T1078)
Tries to pull the Chrome keychain item via security ... find-generic-password -ga "Chrome" and writes a “masterpass-chrome” file. (T1555.001)
Browsers (Chromium family: Chrome, Brave, Edge, Vivaldi, Opera, OperaGX, Chromium, etc.) Walks every Default/Profile * profile and copies: Cookies, Web Data, Login Data (saved logins & autofill). (T1555.003)
Discovery
2 techniques
Discovery
Collection
7 techniques
Collection
Local Extension Settings/ and IndexedDB/ for a very long allowlist of extension IDs (wallets, password managers, etc.). (T1005)
Checks if it can auth the local user with dscl . authonly. If not, it prompts the user with a fake dialog: “Required Application Helper. Please enter device password to continue.” It loops until the correct password is entered. (T1056.002, T1110)
When the wrapper sees a POST request to /api/v1/sign-in, it extracts username and password from the request body Sends both to https://scan-tron[.]link/l?d=
Mirrors directory trees but skips noisy caches (GPUCache, Code Cache, Crashpad, Cache, etc.). (T1074)
Apple Notes database (NoteStore.sqlite, -wal, -shm) + a fallback that talks to the Notes app to export note bodies into HTML; also vacuums Notes attachments from Notes “Media” folders. (T1119, T1113)
Command and Control
2 techniques
Command and Control
IOCs tracked for this family
8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A macOS infostealer used in fake installer campaigns leveraging weaponized DMG files to trick users into approving execution and rapidly exfiltrate sensitive information.
A macOS infostealer platform with an operator panel supporting bot management, credential and cookie theft, seed phrase extraction, SOCKS proxying, AppleScript payload building, log export, persistence, and remote shell/tasking capabilities.
Referenced as a related macOS infostealer variant with similar behavior to Shub Stealer.
Odyssey is a macOS infostealer that, like MacSync Stealer, has adopted code-signed and notarized application delivery methods to evade detection and improve infection rates.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.