FindPOSMalware
- Poseidon
Last reported 3 months ago, by Group-IB4 reports
ATT&CK techniques
6 of 68 · each with the sentence it comes from- T1684Social Engineering
“You can now go back to your browser and reload.” closing the social engineering loop and leaving the victim unaware that their system is being compromised.”
- T1036Masquerading
“T1036”
- T1543.001Launch Agent
“T1543.001”
- T1005Data from Local System
“T1005”
- T1016System Network Configuration Discovery
“T1016”
- T1020Automated Exfiltration
“T1020”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
ClickLock Stealer: Paste Once, Lose Everything“Although the macOS threat landscape has grown considerably in recent years, with malware like Atomic Stealer (AMOS), Banshee Stealer, Poseidon, Cuckoo, Cthulhu Stealer and MacStealer, the total number of known macOS malware families remains relatively small in contrast to other s…”
-
Deceptive Installers: How Fake Apps Target macOS“This is the most common pattern, used by AMOS, Poseidon, Odyssey, and MacSync.”
-
Bit ByBit - emulation of the DPRK's largest cryptocurrency heist“After gaining initial access to the developer's machine, attackers deployed MythicC2's Poseidon agent, a robust Golang-based payload offering advanced stealth and extensive post-exploitation capabilities for macOS environments.”
-
Say Hello to Mac Malware“Infostealers like Poseidon are abusing the AppleScript framework—a scripting language that offers the capability to automate tasks—to simulate prompts that mimic native Apple prompts, with the goal of stealing end user credentials.”
Thanks — we review every report.