Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Odyssey Stealer & AMOS Hit macOS Developers with Fake Homebrew Sites

hunt.io | blog | #phishing | #macos | #homebrew | #info-stealer | #odyssey-stealer | #amos

Summary

A macOS campaign targeting developers via fake Homebrew, TradingView and LogMeIn download portals delivered Odyssey Stealer and AMOS, with 85+ phishing domains tied to multi-year infrastructure.
Published
Collected

original ↗

Related coverage

research · hunt.io
Fake Homebrew Pages Deliver Cuckoo Stealer via ClickFix | macOS Threat Hunting Analysis
Homebrew typosquats delivered Cuckoo Stealer via ClickFix: a first stage stole credentials via dscl authonly prompts, then a macOS infostealer/RAT hitting 20+ wallets and persisting via LaunchAgent.
blog · hunt.io
Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure
A macOS ClickFix campaign uses fake security prompts to push victims into running AppleScript via Terminal, stealing browser data, crypto wallets, and documents without any download.
blog · hunt.io
Unmasking SparkRAT: Detection & macOS Campaign Insights
Hunt.io details how to spot SparkRAT servers via default port 8000 and HTTP Basic auth banners, and examines a suspected DPRK macOS campaign tied to the Golang RAT's WebSocket C2 traffic.
blog · hunt.io
macOS Malware Impersonates The Unarchiver App to Steal User Data
Hunt.io dissects a spoofed The Unarchiver site pushing an unsigned macOS disk image whose 'CryptoTrade' binary and Grabber payload steal user data while evading most security vendors.
blog · hunt.io
SEO Poisoning Campaigns Target Browser Installers and Crypto Sites, Spreading Poseidon, GhostRAT & More
Hunt.io exposes SEO-poisoned lookalike sites pushing trojanized installers for Sleipnir, Signal and TradingView—including a macOS DMG with a Poseidon stealer and GhostRAT on a crypto-themed portal.
blog · blog.trailofbits.com
Our audit of Homebrew
Trail of Bits' Open Tech Fund-sponsored audit of Homebrew found non-critical flaws enabling unexpected code loading and CI/CD attacks that could tamper with bottle builds and exfiltrate secrets.
back