Fake Microsoft Teams Site Uses ClickFix to Deliver Odyssey macOS Stealer
Summary
CloudSEK reports a ClickFix campaign using a fake Microsoft Teams download site to deliver Odyssey, which steals credentials, browser data, Apple Notes, and crypto-wallet files before exfiltrating them and establishing persistence.
Key points
- The fake site, teamsonsoft[.]com, copies a command to the clipboard; macOS users are directed to execute an embedded AppleScript with osascript.
- Odyssey prompts for the device password if needed, then targets keychains, browser cookies and saved logins, Apple Notes, documents, and cryptocurrency wallet data.
- The stealer stages collected files in /tmp/out.zip and uploads the archive to its command-and-control server.
- It establishes persistence with a LaunchDaemon and replaces Ledger Live with a trojanized app.
- CloudSEK found 24 unique IPs associated with the infrastructure cluster.
- The report provides indicators of compromise, a YARA rule, and guidance for network monitoring, endpoint hunting, credential resets, and system recovery.
Article Details
- Attack Vectors
- A ClickFix delivery page impersonating Microsoft Teams prompts macOS users to copy and run a command that executes a base64-encoded AppleScript stealer.
- Odyssey collects credentials, browser data, Apple Notes, files, and cryptocurrency wallet data, archives it as /tmp/out.zip, and sends it to C2 infrastructure.
- The malware establishes persistence with a LaunchDaemon and replaces Ledger Live.app with a trojanized version.
- Defensive Notes
- Monitor for unusual curl POST requests that upload zipped data.
- Audit /Library/LaunchDaemons/ for suspicious com.<digits>.plist files and investigate recent osascript executions.
- Reset Apple ID, browser, and wallet passwords, and reissue keys from uncompromised systems.
- Remove the trojanized Ledger Live.app, clean temporary artifacts, and rebuild infected macOS systems if integrity cannot be guaranteed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | teamsonsoft[.]com | Fake Microsoft Teams download site used to deliver the ClickFix command. |
| IPV4 | 185[.]93[.]89[.]162 | IP identified in the article's indicators section as Odyssey C2 infrastructure. |
| IPV4 | 185[.]93[.]89[.]62 | C2 host described as receiving the stolen archive and serving secondary payloads. |
| SHA256 | 397ee604eb5e20905605c9418838aadccbbbfe6a15fc9146442333cfc1516273 | SHA-256 indicator listed for the Odyssey campaign. |
| SHA256 | 7a8250904e6f079e1a952b87e55dc87e467cc560a2694a142f2d6547ac40d5e1 | SHA-256 indicator listed for the Odyssey campaign. |
| SHA256 | 909038524250903a44efd734710e60a8f73719130176c726e58d3287b22067c8 | SHA-256 indicator listed for the Odyssey campaign. |
| SHA256 | d81cc9380673cb36a30f2a84ef155b0cbc7958daa6870096e455044fba5f9ee8 | SHA-256 indicator listed for the Odyssey campaign. |
| URL | hxxp[:]//185[.]93[.]89[.]62/log | C2 endpoint used to receive the stolen archive. |
MITRE ATT&CK
T1005 · Data from Local SystemThe script collects local files, browser extension stores, and wallet data.T1036 · MasqueradingThe malware replaces Ledger Live.app with a trojanized copy.T1041 · Exfiltration Over C2 ChannelThe script exfiltrates /tmp/out.zip to the C2 host using an HTTP POST.T1053.003 · CronThe script uses launchctl bootstrap to start the LaunchDaemon and falls back to nohup.T1056.002 · GUI Input CaptureA fake dialog prompts for the device password when local authentication fails.T1059.002 · AppleScriptThe delivery command uses osascript to run the embedded AppleScript.T1070.004 · File DeletionThe script deletes its working directory and /tmp/out.zip after upload.T1074 · Data StagedThe script stages collected data in mirrored directory trees before archiving it.T1078 · Valid AccountsThe captured password is stashed in ~/.pwd.T1082 · System Information DiscoveryThe script collects system inventory using system_profiler.T1105 · Ingress Tool TransferThe C2 host serves secondary payloads, including a plist and a Ledger Live archive.T1110 · Brute ForceThe password prompt loops until the correct password is entered.T1112 · Modify RegistryThe malware removes and replaces Ledger Live.app in /Applications.T1113 · Screen CaptureThe script collects Apple Notes database and note-body content.T1119 · Automated CollectionThe script collects Apple Notes data, attachments, browser profiles, and wallet files.T1539 · Steal Web Session CookieThe script collects Safari cookies.T1543.004 · Launch DaemonThe malware installs a LaunchDaemon plist for persistence.T1555 · Credentials from Password StoresThe script captures passwords and collects cryptocurrency wallet data.T1555.001 · KeychainThe script retrieves the Chrome keychain item and copies login keychain data.T1555.003 · Credentials from Web BrowsersThe script copies browser cookies and saved login or autofill data.T1560 · Archive Collected DataThe script archives collected data to /tmp/out.zip using ditto.
Malware
Products
Ledger Livebefore exfiltrating it to its C2. It then establishes persistence via LaunchDaemons and replaces Ledger Live with a trojanized version.Microsoft Teamsdiscovery, CloudSEK’s TRIAD identified that the threat actors are now luring users via a fake Microsoft Teams download site. When victims copy the provided command, a base64-encoded AppleScript stealer (Odyssey)