MalwarePublished 16 Oct 2025Updated 15 Nov 2025

Odyssey Stealer & AMOS Hit macOS Developers with Fake Homebrew Sites

Source AlienVault OTX General

Description

A sophisticated campaign targeting macOS developers has been uncovered, utilizing fake websites impersonating trusted platforms like Homebrew, TradingView, and LogMeIn to distribute Odyssey Stealer and AMOS malware. The attackers employ social engineering tactics, prompting users to paste base64-encoded commands in Terminal, which downloads malicious payloads. Over 85 phishing domains were identified, linked through shared SSL certificates and infrastructure. The campaign's infrastructure includes long-standing IP addresses showing multi-year activity. The malware attempts privilege escalation, performs anti-analysis checks, and disrupts backup services. This coordinated operation demonstrates the attackers' ability to adapt tactics and maintain persistence in the macOS ecosystem.

Impact

European organizations employing macOS systems in development environments face risks including credential theft, intellectual property loss, and potential system compromise. The malware’s ability to escalate privileges and disrupt backup services increases the potential for significant operational disruption and data loss. Developers compromised by this campaign could inadvertently introduce vulnerabilities or malicious code into software supply chains, amplifying the threat beyond initial infection. The social engineering aspect exploits user trust, making technical controls alone insufficient without user awareness. Organizations with remote or hybrid workforces using macOS devices are particularly vulnerable. The persistence and anti-analysis capabilities of the malware complicate detection and remediation efforts, potentially leading to prolonged exposure. The campaign’s infrastructure reuse and long-term activity suggest a sustained threat that could evolve, posing ongoing risks to European software development ecosystems.

Defensive guidance

1. Implement strict policies forbidding the execution of unverified commands in Terminal, especially those received via unsolicited communications or unknown websites. 2. Conduct targeted user awareness training for developers emphasizing the risks of social engineering and the dangers of executing base64-encoded commands from untrusted sources. 3. Deploy endpoint detection and response (EDR) solutions capable of detecting privilege escalation attempts, anti-analysis behaviors, and suspicious network connections to known malicious domains and IPs identified in this campaign. 4. Use DNS filtering and network security controls to block access to the identified phishing domains and associated IP addresses. 5. Enforce multi-factor authentication (MFA) for developer accounts and sensitive systems to reduce the impact of credential theft. 6. Regularly audit and monitor backup services to ensure they are operational and protected from tampering or disruption. 7. Maintain up-to-date macOS security patches and monitor for unusual system behaviors indicative of malware presence. 8. Encourage developers to verify software sources through official channels and avoid downloading tools or updates from unofficial or suspicious websites. 9. Integrate threat intelligence feeds containing indicators of compromise from this campaign into security monitoring tools for proactive detection. 10. Consider application whitelisting or restricting execution privileges for scripts and binaries in developer environments.

Indicators of compromise

Domains 10

bonoud.com
filmoraus.com
homebrewclubs.org
homebrewfaq.org
homebrewonline.org
homebrewupdate.org
logmeeine.com
logmeln.com
sites-phantom.com
tradingviewen.com

URLs 2

https://bonoud.com/get3/install.sh
https://bonoud.com/get6/update

IP addresses 2

195.82.147.38
93.152.230.79

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Oct 2025, 21:44 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details

Indicators of compromise

Domains 10

URLs 2

IP addresses 2

Community reviews

Related threats