Malware

Odyssey Stealer

Indicators of Compromise 13

Domain bonoud[.]com Domain filmoraus[.]com Domain homebrewclubs[.]org Domain homebrewfaq[.]org Domain homebrewonline[.]org Domain homebrewupdate[.]org Domain logmeeine[.]com Domain logmeln[.]com Domain sites-phantom[.]com Domain tradingviewen[.]com Filename install.sh IP 195[.]82[.]147[.]38 IP 93[.]152[.]230[.]79

MITRE ATT&CK TTPs 13

T1016
System Network Configuration Discovery
Discovery
 T1027
Obfuscated Files or Information
Defense Evasion
 T1048
Exfiltration Over Alternative Protocol
Exfiltration
 T1055
Process Injection
Defense Evasion
 T1056.002
GUI Input Capture
Collection
 T1059.001
PowerShell
Execution
 T1069.001
Local Groups
Discovery
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1083
File and Directory Discovery
Discovery
 T1210
Exploitation of Remote Services
Lateral Movement
 T1485
Data Destruction
Impact

Source Articles

Odyssey Stealer & AMOS Hit macOS Developers with Fake Homebrew Sites
A macOS-targeted campaign dubbed 'Odyssey Stealer & AMOS' is actively distributing malware to developers through fake software download sites impersonating trusted platforms like Homebrew, TradingView, and LogMeIn. Attackers use social engineering tactics, including clipboard manipulation and base64-encoded commands, to trick users into executing malicious payloads. The campaign leverages reused infrastructure, including IP addresses and SSL certificates, to distribute stealer malware capable of harvesting system data, browser credentials, and cryptocurrency wallets.
hunt.io