Odyssey Stealer is a macOS infostealer sold as
malware-as-a-service by a Russian-speaking operator. Public
reporting tracks it as a rebrand of Poseidon Stealer, which
itself forked from the AMOS Stealer codebase. Public research
documented the ClickFix delivery chain in April 2026, and a
follow-on evolution writeup covered new obfuscation and
code-signing techniques. A separate writeup covers the same
campaign from the delivery-side view.
The stealer runs as an AppleScript compiled file (.scpt)
launched via osascript. Its info file opens with External IP: <ipv4>, then a bare System Info header, then Username: /
Password: / Hostname: / OS Version: / Is CIS: boolean
fields, then verbatim system_profiler SPSoftwareDataType /
SPHardwareDataType / SPDisplaysDataType output. The Is CIS: flag is set by inspecting
~/Library/Preferences/com.apple.HIToolbox.plist for a
Russian keyboard layout; the beacon reports the flag so the
operator can filter or drop CIS victims per campaign. The
harvested password is captured through a fake authentication
dialog rendered via osascript.
