Odyssey Stealer's shared codebase

Summary

Three page variants, one codebase. Each reads the user-agent string and hands out a different clipboard payload per platform, and in every case the text on screen is not the text that gets copied. The first serves macOS a Base64-wrapped shell command that fetches Odyssey, and Windows a PowerShell line for a payload Unit 42 could not name. The second targets macOS and gives Windows only a harmless decoy that completes the lure without infecting anything, at times with Cyrillic letters standing in for Latin ones in the domain shown. The third drops the branching and offers the macOS command alone, backgrounded so that closing the window does not stop it. Layout and function naming match across all of them, some carry Russian developer comments left in place, and every C2 traced back to Odyssey, which its operator sells as a service on Exploit and XSS.

Overlap with other campaigns

We compared the 51 indicators in this record — covering 24 distinct registrable domains — against the 43 other published campaigns in this corpus.

• SHub Stealer via macOS Terminal

  2026-08-07

  No indicator is shared, but the two records use the same registrable domains.

  Shared registrable domain (1)

  • us[.]comdomain, shown defanged for safety: us dot com

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

5 of 51

Checks recorded

6

Checks since publication

6

Never checked

46

Observation window 2026-08-10 to 2026-08-22. Checks are sampled, not continuous; the sampling policy is on /methodology. 46 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Execution mechanisms

The only execution mechanism any published account describes for this campaign is Terminal paste (macOS) (T1059.004), which 8 of the 44 published campaigns in this corpus also record (18%).

Indicators

51 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.