Skip to content
844-974-8669 Ask Zeus Book a call

Intelligence briefFall/Winter 2026/2027 Edition

Odyssey Stealer now leads macOS stealer detections and replaces wallet apps

Moonlock puts Odyssey at 62.7 percent of macOS stealer detections in early 2026. It now swaps wallet apps for drainers and takes cloud keys. Block Terminal paste lures, patch macOS and revoke sessions fast.

Download the PDF, 821 KB Talk to the SOC

At a glance

IS-01 · Infostealer

  • 62.7% of macOS stealer detections, first half of 2026[1]
  • 100+ countries with infections, per Moonlock in July 2026[4]
  • about 300 wallet extension IDs targeted[4]
  • 10 C2 hosts mapped across six autonomous systems[3]
Status
Active. Odyssey accounted for 62.7 percent of macOS stealer detections in Moonlock's first-half 2026 telemetry, and no law enforcement action against it was found.[1]
Initial access
ClickFix pages: fake CAPTCHA or download, paste command into Terminal[2]
Lineage
AMOS fork, Poseidon rebrand; developer alias Rodrigo4[3]
Business model
Malware-as-a-service; 2023 forum ad priced $3,000 a month, 15 affiliates[3]
Harvests
Browser logins and cookies, Keychain, about 300 wallet extensions, 16 wallet apps, SSH and cloud keys[4]
Persistence
LaunchDaemon that polls the panel every 60 seconds, plus a Go-compiled SOCKS5 proxy[3]
Infrastructure
10 C2 hosts across six autonomous systems in five countries[3]

What happened

The original edition, written in February 2026, tracked Odyssey as a fast-spreading ClickFix credential thief. By July 2026 Moonlock Lab was reporting infections in more than 100 countries, and its mid-year report put Odyssey at 62.7 percent of all macOS stealer detections. The stealer now replaces Ledger Live, Trezor Suite and Exodus with trojanized drainer builds and takes developer and cloud credentials alongside wallets and browser data.

  • Moonlock Lab's July 2026 findings, reported by Cyber Security News and GBHackers, describe about 300 cryptocurrency wallet extension IDs and 16 desktop wallet applications in scope, up from the original edition's 203 and 18, plus SSH keys and AWS, Google Cloud, Azure and Docker configuration.
  • Censys fingerprinted the Odyssey control panel and mapped 10 C2 hosts across six autonomous systems in five countries on February 11, 2026; later panels dropped the Odyssey name for a generic MacOS - Advanced Dashboard title.
  • ClickFix is still the most common way in: Moonlock's first-half telemetry shows fake Homebrew, TradingView and LogMeIn lures, its October 2026 post citing Point Wild calls ClickFix the most popular technique on Macs, and in May 2026 it found three samples posing as a macOS build of OpenAI Codex that none of 72 engines detected a week after upload.
  • Apple added a Terminal paste warning in macOS Tahoe 26.4 (released March 24, 2026) and shipped macOS Golden Gate 27 on September 14, 2026 with administrator controls that allow or deny executables by code-signing properties; XProtect reached version 5367 on October 13, 2026.
  • Flare's analysis of 18.7 million 2025 stealer logs found Microsoft Entra ID credentials in 79 percent of enterprise identity logs and projected that one in five infections could expose enterprise credentials as early as the third quarter of 2026.
  • No arrest, seizure or takedown tied to Odyssey or its developer was found. The June 2026 Operation Endgame phase neutralized 326 servers and 142 domains behind SocGholish, StealC and Amadey, not Odyssey.

How it works

The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.

at risk
  • entry
  • next step
  • impact

Read the attack chain

The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
00the attack chain
  • entry
  • next step
  • impact

Tap a node to read its story.

Step by step

  1. Lure through ads and lookalike sites

    MITRE ATT&CK T1566 (opens in a new tab)

    Ads, search results and phishing steer users to pages impersonating Homebrew, TradingView, LogMeIn, Microsoft Teams or Ledger Live. Hunt.io tied 85 hostnames to one base64 installer pattern in October 2025.

  2. ClickFix paste into Terminal

    MITRE ATT&CK T1204 (opens in a new tab)

    A fake CAPTCHA or install step tells the user to copy a base64 command and paste it into Terminal. The command pipes to bash, fetches a script with curl and runs AppleScript through osascript, so no traditional download is needed.

  3. Fake password prompt

    MITRE ATT&CK T1056.002 (opens in a new tab)

    The script checks the typed password with dscl . authonly and, if it fails, shows a fake dialog headed Required Application Helper until the right password is entered. The password lets it unlock copied Keychain files.

  4. Collect wallets, browsers and keys

    MITRE ATT&CK T1555.001 (opens in a new tab)

    It copies Keychain files, browser logins, cookies and autofill from Chromium browsers, Firefox and Safari, about 300 wallet extensions, 16 wallet apps, Apple Notes, Desktop and Documents files, SSH keys and cloud CLI configuration.

  5. Zip and post to the panel

    MITRE ATT&CK T1020 (opens in a new tab)

    Everything is staged as out.zip under /tmp and sent by curl POST to the C2 /log endpoint with silent retries, then the staging files are removed.

  6. Persist, proxy and replace wallets

    MITRE ATT&CK T1543.004 (opens in a new tab)

    A LaunchDaemon with a random com.<id>.plist label keeps an osascript loop polling the C2 every 60 seconds, a Go-compiled SOCKS5 proxy can turn the Mac into a relay, and Ledger Live, Trezor Suite and Exodus are killed, deleted and replaced with drainer builds that ask for PINs and recovery phrases.

Who is at risk

Anyone who runs a Mac and is used to pasting commands from the web is in scope; the operation avoids CIS countries and Moonlock reports infections in more than 100. The payoff is highest where one Mac holds wallet seeds, cloud keys or enterprise single sign-on.

  • Software developers who install from Homebrew and follow Terminal instructions without a second look.
  • Cryptocurrency holders and finance staff, the explicit target of the wallet extension list and the trojanized Ledger, Trezor and Exodus builds.
  • Engineers whose Macs carry SSH keys and AWS, Google Cloud, Azure or Docker credentials, now harvested alongside browser data.
  • Media, creative and education environments with high Mac adoption and thinner endpoint tooling.
  • Any organization using Microsoft Entra ID, which Flare found in 79 percent of enterprise identity logs.

Sectors in scope

  • Technology and software development
  • Financial services and cryptocurrency
  • Media and creative industries
  • Education
  • Remote and hybrid workforces
04What changed

What changed since the last edition

Fall/Winter 2026/2027 Edition8 changes

  1. Scale and scope: Moonlock Lab reported Odyssey infections in more than 100 countries in July 2026, with about 300 wallet extension IDs and 16 desktop wallet apps in scope, plus SSH keys, AWS, Google Cloud, Azure and Docker configuration, FileZilla logins, Telegram and Discord data and shell history.

    Source 4

  2. Market position: Moonlock's mid-2026 report puts Odyssey at 62.7 percent of macOS stealer detections against 29.8 percent for AMOS, says AMOS operators went quiet in late 2025, and found fake macOS builds of OpenAI Codex in May 2026 whose second stage matched Odyssey with zero detections a week after upload.

    Source 1

  3. Wallet replacement became the headline capability: the malware kills and deletes Ledger Live, Trezor Suite and Exodus and downloads drainer builds that mimic the originals and prompt for PINs and recovery phrases.

    Source 5

  4. Apple's Terminal paste warning in macOS Tahoe 26.4 did not hold: Moonlock's report says Jamf Threat Labs found a bypass that opens Script Editor through the applescript:// URL scheme, so the warning never fires, and adds that notarized does not mean safe because roughly one fifth of malicious Mach-O uploads carried valid or recently revoked Apple Developer certificates.

    Source 1

  5. Infrastructure picture corrected: Censys's February 11, 2026 analysis maps 10 C2 hosts across six autonomous systems in the Netherlands, Germany, Singapore, Lithuania and Russia and names no registrant; the original edition's two-autonomous-system, Helsinki framing does not match the published research.

    Source 3

  6. macOS Golden Gate 27 (September 14, 2026) lets administrators allow or deny executables by code-signing properties through declarative management, and Endpoint Security can terminate processes tied to a denied binary.

    Source 6

  7. Current Apple baseline: macOS Golden Gate 27.0.1, Tahoe 26.7.1 and Sequoia 15.8.1 shipped September 28, 2026, and Tahoe 26.7.1 fixes a CoreGraphics out-of-bounds write (CVE-2026-86950) that Apple said may have been exploited in an extremely sophisticated attack against specific individuals on iOS versions before iOS 27.

    Source 7

  8. No enforcement: no arrest, seizure or takedown tied to Odyssey or its developer was found as of October 2026; the June 15 to 19, 2026 Operation Endgame phase neutralized 326 servers and 142 domains behind SocGholish, StealC and Amadey.

    Source 8

What to do now

In priority order, highest impact first.

  1. Do firstTeach every Mac user one rule: never paste a command from a web page, call or document into Terminal or Script Editor, and report any site that asks.

    ClickFix is the most common entry point and relies entirely on the user doing the work for the attacker.

  2. Move Macs to macOS Golden Gate 27.0.1 or Tahoe 26.7.1, keep XProtect current, and use the macOS 27 executable allow and deny rules to block unexpected binaries.

    Both builds shipped September 28, 2026, and the code-signing rules stop droppers and drainer builds before they run; do not rely on the Tahoe 26.4 Terminal paste warning, which has already been bypassed.

  3. Deploy EDR detections for osascript spawning curl, dscl . authonly after a password dialog, new plists in /Library/LaunchDaemons, shell archiving of Application Support folders and out.zip under /tmp.

    Hashes rotate per sample, while these behaviors recur across the Forcepoint, CloudSEK, Censys and SOC Prime analyses.

  4. Verify code signatures on Ledger Live, Trezor Suite and Exodus, alert on their deletion or replacement, and keep hardware wallet recovery phrases off any computer.

    The drainer builds look like the originals and ask for the PIN and seed; a hardware wallet cannot protect a seed typed into a fake app.

  5. On any suspected infection, revoke all browser sessions, reset passwords and rotate SSH keys, cloud CLI credentials, Docker and FileZilla secrets the same day.

    Odyssey takes session cookies that bypass MFA and now takes cloud and developer keys, so password resets alone leave access open.

  6. Enforce phishing-resistant MFA with short session lifetimes on Entra ID and other identity providers, and monitor stealer-log marketplaces for your domains.

    Flare found Entra ID credentials in 79 percent of enterprise identity logs and expects one in five infections to expose enterprise credentials from the third quarter of 2026.

  7. Block newly registered domains containing homebrew, macos, macapp, tradingview, ledger or teams at DNS, and treat ads for software downloads as untrusted.

    Hunt.io and Moonlock traced the campaigns to lookalike domains; Z7's 24/7 SOC and Microsoft 365 posture review cover the identity and endpoint layers described here.

Indicators

Indicators the sources publish, shown as they print them. Use them to hunt and to enrich alerts, and check the source before you block.

Indicators published by the sources
TypeIndicatorSource
ip 213.209.159[.]175 [3]
ip 62.60.131[.]230 [3]
ip 62.60.131[.]250 [3]
ip 5.199.166[.]102 [3]
ip 77.90.185[.]24 [3]
ip 185.11.61[.]84 [3]
ip 217.119.139[.]117 [3]
ip 185.93.89[.]62 [3]
ip 185.93.89[.]63 [3]
ip 45.146.130[.]129 [3]
ip 45.146.130[.]131 (panel host in the August 2025 analysis) [9]
domain something0x[.]at [3]
domain charge0x[.]at [3]
domain sdojifsfiudgigfiv[.]to [3]
domain odyssey1[.]to [10]
domain odyssey-st[.]com [10]
ip 165.245.215[.]18 (primary C2, July 2026) [4]
domain rahtam[.]com (fallback C2, July 2026) [4]
domain scubin[.]com (fallback C2, July 2026) [4]
ip 93.152.230[.]79 (phishing and payload backend, web and SSH active since September 2023) [11]
ip 195.82.147[.]38 (second host presenting the same certificate) [11]
domain homebrewclubs[.]org [11]
domain homebrewfaq[.]org [11]
domain homebrewonline[.]org [11]
domain homebrewupdate[.]org [11]
domain logmeln[.]com [11]
domain logmeeine[.]com [11]
domain tradingviewen[.]com [11]
domain sites-phantom[.]com [11]
domain filmoraus[.]com [11]
domain teamsonsoft[.]com (fake Microsoft Teams download site) [12]
hash a0bdf6f602af5efea0fd96e659ac553e0e23362d2da6aecb13770256a254ef55 (AppleScript payload) [10]
hash d254125912d9e9e5c271766bc4f6eea0c296ad2c0cf19d4bd57081d1bf10f044 (Go-compiled SOCKS5 universal Mach-O, identical across C2s) [3]
file /tmp/lovemrtrump/ staging directory [10]
file /tmp/out.zip [9]
file /Library/LaunchDaemons/com.<5-digit number>.plist with KeepAlive and RunAtLoad set [3]
behavior osascript spawning curl; ditto or zip of Application Support directories; shell writing to /Library/LaunchDaemons; HTTP POST to /log [13]
behavior osascript -e 'run script' alongside dscl . authonly and a fake dialog headed Required Application Helper (CloudSEK YARA rule OSX_Odyssey_Osascript_Exec) [12]
behavior Panel HTML title MacOS - Advanced Dashboard (earlier Odyssey - Advanced Dashboard) [3]
behavior Censys query: host.services.threats.name: "Odyssey Stealer" or web.threats.name: "Odyssey Stealer" [3]

Sources

Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.

  1. [1]
    Moonlock's mid-2026 macOS threat report (opens in a new tab) Moonlock Lab · July 16, 2026 · moonlock.com
  2. [2]
  3. [3]
  4. [4]
  5. [5]
  6. [6]
    Apple overhauls security with iOS and macOS 27 (opens in a new tab) iTnews · September 15, 2026 · itnews.com.au
  7. [7]
  8. [8]
  9. [9]
  10. [10]
  11. [11]
  12. [12]
  13. [13]
    Odyssey Stealer: macOS Crypto Wallet Theft via MaaS (opens in a new tab) SOC Prime · February 13, 2026 · socprime.com
  14. [14]
    Apple has released an update to XProtect for all macOS (version 5319) (opens in a new tab) The Eclectic Light Company · October 15, 2025 · eclecticlight.co
  15. [15]
    Apple has released an update to XProtect for all macOS (version 5326) (opens in a new tab) The Eclectic Light Company · January 22, 2026 · eclecticlight.co
  16. [16]
    How XProtect is hunting scripts (opens in a new tab) The Eclectic Light Company · February 5, 2026 · eclecticlight.co
  17. [17]
  18. [18]
    Apple iOS Zero-day Vulnerability Exploited in Attacks (CVE-2026-20700) (opens in a new tab) Qualys ThreatProtect · February 12, 2026 · threatprotect.qualys.com
  19. [19]
  20. [20]
    Apple security releases (opens in a new tab) Apple · page published September 28, 2026 · support.apple.com
  21. [21]
  22. [22]
  23. [23]
    ATT&CK versions (opens in a new tab) MITRE · v20.0 released April 28, 2026 · attack.mitre.org
  24. [24]
  25. [25]
    Apple has released an update to XProtect for all macOS (version 5325) (opens in a new tab) The Eclectic Light Company · December 16, 2025 · eclecticlight.co

Z7 Weekly Intelligence

We aim for one email a week: the threats that matter, new Z7 intelligence briefs and articles, and what to do about them. Unsubscribe anytime.

By subscribing, you agree to our Terms of Use. Our Privacy Policy explains how we use your email.

All Z7 Cyber Intelligence briefs
  • RW-07Ransomware ecosystem ongoing risk

    Most dangerous cybercrime groups, re-ranked

    TakeawayPatch edge devices, require phishing-resistant MFA and test backups first.

    • 2,139 leak-site victims in Q2 2026, up 33 percent year over year
    • 93 active groups in Q2 2026, a record for a quarter
    • Most dangerous cybercrime groups
    • Ransomware ecosystem
    • Manufacturing
    PDF820 KB
  • SP-01Spyware vendor active

    Part 1 of 2

    Predator persists as Greece convicts four

    TakeawayPatch phones fast and use Lockdown Mode for high-risk staff.

    • 15 zero-days attributed to Intellexa since 2021
    • 4 convicted in Athens, sentences suspended pending appeal
    • Intellexa (Predator spyware)
    • Spyware vendor
    • Journalists and press freedom organizations
    PDF790 KB
  • RW-06Ransomware ecosystem active

    RaaS fragments as Qilin and The Gentlemen lead

    TakeawayHarden edge devices, identity and hypervisors now.

    • 93 active leak-site groups in Q2 2026
    • 2,139 leak-site victims in Q2 2026
    • Ransomware-as-a-service ecosystem
    • Ransomware ecosystem
    • Critical manufacturing
    PDF777 KB

What does this mean for your security?

Bring your questions about exposure, defenses and cost. Talk with our team about what applies to your environment and where to start.

Book a security conversationAsk Zeus Call 844-974-8669
Ask Zeus AI assistant