Koushik Pal

Threat actors are exploiting a fake Microsoft Teams download site to deliver the Odyssey macOS stealer via Clickfix. Once executed, the malware harvests credentials, cookies, Apple Notes, and crypto wallets, exfiltrating data to a C2 server before ensuring persistence through LaunchDaemons and even replacing Ledger Live with a trojanized version. The campaign poses severe risks of credential theft, financial loss, and long-term reinfection.

CloudSEK uncovered that the Androxgh0st botnet compromised a University of California, San Diego subdomain to host its C2 logger. Active since 2023, the botnet exploits vulnerabilities in Apache Shiro, Spring4Shell, WordPress, IoT devices, and more for remote code execution and cryptomining. Webshells were also deployed for persistence.