This campaign involves a coordinated effort to distribute two malware families, Odyssey Stealer and AMOS, targeting macOS developers by exploiting their trust in widely used platforms like Homebrew, TradingView, and LogMeIn. Attackers create over 85 phishing domains that closely mimic legitimate sites, sharing SSL certificates and infrastructure to appear credible. The infection vector relies heavily on social engineering, where victims are persuaded to paste base64-encoded commands into the macOS Terminal. These commands download malicious payloads from attacker-controlled URLs such as bonoud.com. Once executed, the malware attempts to escalate privileges to gain deeper system access, conducts anti-analysis techniques to avoid sandboxing or forensic detection, and disrupts backup services to hinder recovery efforts. The campaign infrastructure includes IP addresses with multi-year activity, demonstrating persistence and adaptability. The malware leverages multiple MITRE ATT&CK techniques including T1056.001 (Input Capture), T1548.003 (Abuse Elevation Control Mechanism), T1204.002 (User Execution: Malicious File), and others related to credential access and defense evasion. The targeted nature of this campaign against macOS developers suggests a focus on stealing intellectual property, credentials, or sensitive development environment data. The absence of a CVSS score and the medium severity rating reflect the complexity and targeted scope rather than widespread impact. Indicators of compromise include specific domains and IP addresses linked to the campaign, which can be used for detection and blocking.

European organizations employing macOS systems in development environments face risks including credential theft, intellectual property loss, and potential system compromise. The malware’s ability to escalate privileges and disrupt backup services increases the potential for significant operational disruption and data loss. Developers compromised by this campaign could inadvertently introduce vulnerabilities or malicious code into software supply chains, amplifying the threat beyond initial infection. The social engineering aspect exploits user trust, making technical controls alone insufficient without user awareness. Organizations with remote or hybrid workforces using macOS devices are particularly vulnerable. The persistence and anti-analysis capabilities of the malware complicate detection and remediation efforts, potentially leading to prolonged exposure. The campaign’s infrastructure reuse and long-term activity suggest a sustained threat that could evolve, posing ongoing risks to European software development ecosystems.

1. Implement strict policies forbidding the execution of unverified commands in Terminal, especially those received via unsolicited communications or unknown websites. 2. Conduct targeted user awareness training for developers emphasizing the risks of social engineering and the dangers of executing base64-encoded commands from untrusted sources. 3. Deploy endpoint detection and response (EDR) solutions capable of detecting privilege escalation attempts, anti-analysis behaviors, and suspicious network connections to known malicious domains and IPs identified in this campaign. 4. Use DNS filtering and network security controls to block access to the identified phishing domains and associated IP addresses. 5. Enforce multi-factor authentication (MFA) for developer accounts and sensitive systems to reduce the impact of credential theft. 6. Regularly audit and monitor backup services to ensure they are operational and protected from tampering or disruption. 7. Maintain up-to-date macOS security patches and monitor for unusual system behaviors indicative of malware presence. 8. Encourage developers to verify software sources through official channels and avoid downloading tools or updates from unofficial or suspicious websites. 9. Integrate threat intelligence feeds containing indicators of compromise from this campaign into security monitoring tools for proactive detection. 10. Consider application whitelisting or restricting execution privileges for scripts and binaries in developer environments.