Fake Homebrew Sites Deliver Odyssey Stealer and AMOS to macOS Users
Summary
Researchers detail a campaign targeting macOS users with fake software download sites that use clipboard-injected Terminal commands to install Odyssey Stealer or AMOS. They identified more than 85 related phishing domains and mapped shared infrastructure.
Key points
- The campaign impersonates Homebrew, TradingView, LogMeIn, and other platforms to target macOS users, particularly developers.
- Fake sites copy base64-encoded commands to visitors’ clipboards, encouraging them to paste and run commands in Terminal.
- The commands fetch remote scripts that download and execute malware; the installer clears macOS quarantine attributes before running its payload.
- The delivered malware, Odyssey Stealer or AMOS, can collect system information, browser data, and cryptocurrency credentials.
- Researchers identified more than 85 phishing domains and linked infrastructure through shared certificates, DNS history, and other indicators.
- The analyzed payload checks for virtualized environments, profiles hardware, attempts to run through sudo, and terminates some OneDrive processes.
- The report recommends blocking known infrastructure, restricting execution from risky paths, and warning users not to run commands from untrusted sites.
Article Details
- Attack Vectors
- Fake download pages impersonating Homebrew, LogMeIn, and TradingView prompt macOS users to click a button that copies a hidden Base64-encoded command to the clipboard, then paste and run it in Terminal.
- The command uses curl to retrieve and execute remote shell scripts, which download and run a payload.
- The installer clears macOS extended attributes with xattr -c, makes the downloaded file executable, and runs it.
- The analyzed payload invokes sudo in an attempt to run with elevated privileges.
- The payload checks system and hardware information for virtualization or analysis-environment indicators and exits when some indicators are found.
- The payload collects hardware and memory details and terminates Microsoft OneDrive updater or sync processes.
- Defensive Notes
- Block the listed malicious domains and IP addresses at DNS and proxy layers; monitor outbound requests to newly registered hosts and known payload paths.
- Enable Gatekeeper and notarization, and restrict script execution from /tmp and user-writable paths through MDM or EDR policies.
- Remove passwordless sudo, limit administrator accounts, and require approval or MFA for privileged operations.
- Hunt for suspicious Base64 clipboard content and sequences involving xattr -c, chmod +x, and execution from /tmp; correlate findings with certificate reuse and hosting IPs.
- Warn developers not to paste commands from untrusted sites and direct them to verify installers through official repositories or vetted internal mirrors.
- Route web egress through a proxy with content inspection and block direct curl or wget requests to unapproved destinations.
- For suspected infections, isolate hosts, preserve memory and logs, and collect installer scripts and crawled HTML for forensic analysis.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | filmoraus[.]com | Phishing and impersonation domain identified during campaign domain enumeration. |
| DOMAIN | homebrewclubs[.]org | Fake Homebrew phishing domain that historically resolved to campaign infrastructure. |
| DOMAIN | homebrewfaq[.]org | Fake Homebrew phishing domain that historically resolved to campaign infrastructure. |
| DOMAIN | homebrewonline[.]org | Fake Homebrew phishing domain used for payload delivery. |
| DOMAIN | homebrewupdate[.]org | Fake Homebrew phishing domain. |
| DOMAIN | logmeeine[.]com | LogMeIn typosquatting phishing domain. |
| DOMAIN | logmeln[.]com | Fake LogMeIn phishing domain. |
| DOMAIN | sites-phantom[.]com | Phishing and impersonation domain identified during campaign domain enumeration. |
| DOMAIN | tradingviewen[.]com | Fake TradingView phishing domain. |
| IPV4 | 195[.]82[.]147[.]38 | Secondary campaign host linked through reuse of the SSL certificate. |
| IPV4 | 93[.]152[.]230[.]79 | Backend hosting and phishing infrastructure linked to fake Homebrew sites. |
| URL | hxxps[:]//bonoud[.]com/get3/install[.]sh | Malicious installer script URL fetched by the fake download page. |
| URL | hxxps[:]//bonoud[.]com/get6/update | Malicious payload URL downloaded and executed by the installer. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe command placed on the clipboard is Base64-encoded to conceal its contents.T1059.004 · Unix ShellThe infection chain uses shell commands and executes downloaded scripts through bash.T1082 · System Information DiscoveryThe payload queries system_profiler for hardware and memory details to profile the host.T1105 · Ingress Tool Transfercurl downloads the installer script and payload from remote URLs.T1204.004 · Malicious Copy and PasteFake download pages use ClickFix-style instructions to get victims to paste and run a hidden command.T1489 · Service StopThe payload terminates Microsoft OneDrive updater or sync processes.T1497.001 · System ChecksThe payload checks for virtualization and analysis-environment indicators and exits when some are detected.T1548.003 · Sudo and Sudo CachingThe payload invokes sudo to attempt execution with elevated privileges.
People
Malware
Atomic macOS Stealer (AMOS)This report explains how those techniques deliver Odyssey Stealer and AMOS, and maps the related infrastructure, domains, and payload behavior.Odyssey StealerThis report explains how those techniques deliver Odyssey Stealer and AMOS, and maps the related infrastructure, domains, and payload behavior.
Products
FASTPANELIn addition, port 8888 was observed serving a web management interface tied to FASTPANEL, a control panel commonly used for managing multiple domains from a single administrative console. Each service returned aHomebrewThe campaign targets macOS users, particularly developers, through fake software download websites impersonating trusted platforms such as Homebrew, TradingView, and LogMeIn.LogMeInThe campaign targets macOS users, particularly developers, through fake software download websites impersonating trusted platforms such as Homebrew, TradingView, and LogMeIn.macOSIn recent months, our threat hunting team has observed a surge in macOS-targeted campaigns employing new social engineering tactics and persistent infrastructure.Microsoft OneDrivelaunchctl kill SIGTERM commands targeting Microsoft OneDrive updater daemons. Terminating OneDrive update or sync processes is consistent with an intent to disrupt cloud backup and synchronization, which can reduce theTradingViewThe campaign targets macOS users, particularly developers, through fake software download websites impersonating trusted platforms such as Homebrew, TradingView, and LogMeIn.