A new wave of Odyssey infostealer activity is targeting macOS users across more than 100 countries, stealing browser credentials, cryptocurrency wallets, cloud configuration files, and messaging app data.
The malware also establishes persistence and can replace legitimate crypto-wallet applications with trojanized versions designed to drain victims’ funds.
Researchers warn that Odyssey is built to collect a broad range of high-value data from Apple devices.
Its focus on browser sessions, macOS Keychain data, crypto assets, and developer credentials makes it a serious threat to both individual users and organizations.
Odyssey Steals Mac Crypto Wallets
Odyssey targets browser data stored by Chrome, Brave, Microsoft Edge, Vivaldi, Opera, Arc, Firefox, and Waterfox. The malware can harvest saved passwords, cookies, autofill records, and active browser-session information.
Stolen browser cookies can be especially dangerous because attackers may use them to hijack authenticated sessions without immediately needing a victim’s password.
This can expose email accounts, corporate software-as-a-service platforms, cryptocurrency exchanges, and cloud-management portals.
The infostealer also collects the macOS Keychain database, which may contain saved passwords, certificates, Wi-Fi credentials, private keys, and other sensitive secrets.
In addition, it attempts to retrieve a local account password using the macOS Directory Service command-line utility, dscl. Odyssey heavily targets cryptocurrency users.
It searches for wallet files associated with more than 161616 applications, including Electrum, Exodus, Ledger Live, Trezor Suite, Bitcoin Core, Litecoin Core, Dash Core, and Monero wallets.
It also looks for roughly 300 browser extension identifiers linked to cryptocurrency wallets. Beyond wallet data, the malware also collects SSH private keys and cloud service configuration files.
Targeted files may include credentials and settings for AWS, Google Cloud Platform, Microsoft Azure, and Docker. These artifacts could grant attackers access to cloud environments, source code repositories, servers, and container infrastructure.
Other targeted data includes FileZilla login details, Telegram and Discord information, Zsh command history, and local system files that may reveal credentials or operational activity.
Odyssey does not operate only as a data-stealing tool. It can install a persistent macOS LaunchDaemon, allowing it to run automatically and remain active after a system restart.
LaunchDaemons are legitimate macOS mechanisms for running background services, but malware often abuses them to maintain long-term access.
The campaign also reportedly replaces selected legitimate cryptocurrency applications with malicious “drainer” versions. Ledger Live, Trezor Suite, and Exodus are among the applications targeted for substitution, moonlock said.
A drainer application can mimic a trusted wallet interface, persuading victims to disclose recovery phrases, approve malicious transactions, or send assets to attacker-controlled addresses.
This tactic increases the risk for victims who believe they are using genuine wallet software. Even after an initial theft event, a trojanized application could continue to expose new deposits and future cryptocurrency transactions.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
