Odyssey steals wood horses, attacks on MacOS users, steals wallets and system sensitive information

On 9 July, according to Moonlock Lab monitoring, the MacOS platform, Odyssey, recently surged, affecting more than 100 countries. The variant can steal passwords for browsers such as Chrome, Brave, Edge, Cookie and auto-filling data, steal wallet files for 16 or more encrypted applications such as Electrum, Exodus, Ledger Live and about 300 encrypted extension IDs, access SSH keys, cloud service configurations, Keychain database, Telegram and Discord data, and install backstage services for start-up in the system, replacing Leedger, Trezor and Exodus applications with wooden horse versions of stolen assets. The address of the C2 server has been publicly disclosed。