Poseidon is a macOS malware-as-a-service infostealer that emerged in mid-2024, built heavily on the Atomic Stealer (AMOS) codebase. Developed by a Russian-speaking actor, it was distributed largely through malvertising and trojanized DMG installers, and it steals browser data, crypto wallets, password-manager vaults, Notes content and VPN configurations, relying like AMOS on AppleScript. It was later sold and rebranded as Odyssey Stealer, continuing the AMOS lineage.
Overview
Poseidon was first tracked by Malwarebytes as OSX.RodStealer, after the author handle “Rodrigo4,” and announced under the Poseidon name on 23 June 2024. It is offered with a management panel and a builder that lets affiliates customise the name, icon and AppleScript. A specific subscription price could not be verified from public reporting. It shares significant code with Atomic/AMOS, and Red Canary and Zscaler later grouped Atomic, Poseidon and Odyssey as one lineage.
Delivery
- Malvertising: on 24 June 2024, Malwarebytes observed Google ads impersonating the Arc browser leading to a malicious DMG. T1036
- Trojanized installers and spam delivering DMGs; typosquatted download domains.
Technical Capabilities
- Browser data and cryptocurrency wallet theft. T1555.003
- Password-manager vault theft from Bitwarden and KeePassXC (Unit 42), and Notes content. T1555
- VPN configuration theft, added in the June 2024 release.
- Heavy use of AppleScript, including a fake password prompt to obtain the login password. T1059.002 T1056.002
Specific wallet targets named in reporting on other macOS stealers are not attributed to Poseidon here without a primary source.
MITRE ATT&CK Mapping
Poseidon has no official ATT&CK Software entry; techniques are analyst-mapped from documented behaviour.
| Tactic | Technique | Usage |
|---|---|---|
| Execution | T1059.002 AppleScript | osascript-driven collection |
| Collection | T1056.002 GUI Input Capture | Fake password prompt |
| Credential Access | T1555 Password Stores | Bitwarden, KeePassXC |
| Credential Access | T1555.001 Keychain | Keychain access |
| Defense Evasion | T1036 Masquerading | Fake Arc browser |
Detection & Mitigation
- Alert on
osascriptpassword dialogs and AppleScript collection chains; monitor Keychain andsecurity/dscluse. - Block malvertising with ad-blocking and download reputation; verify downloads come from official domains and watch typosquats.
- Enforce Gatekeeper and notarization; treat password-manager and VPN config access by non-owner processes as high-signal.
Defend macOS Fleets
Mjolnir Security helps organisations detect macOS stealers and the credential theft they enable.
- Managed Detection and Response macOS coverage for AppleScript collection, fake-password prompts and password-manager access.
- Threat Hunting as a Service Hunting for malvertising-driven DMG delivery and osascript social-engineering chains.
- 24/7 Incident Response Containment and credential rotation when macOS stealer activity is detected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts