HOMETHREATSPoseidon Stealer
APT / THREAT GROUP

Poseidon Stealer

3
aliases
Last seen:Mar 17, 2026

Intelligence Profile

macOS infostealer sold by an individual named Rodrigo4, currently consisting of a disk image containing a Mach-O without app bundle, which when executed spawns osascript executing an AppleScript with the actual infostealer payload. The AppleScript payload will steal files by packing them in a ZIP archive and uploading them to a hardcoded C2 via HTTP.

Threat Analysis

Poseidon Stealer is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://github.com/govcert-ch/CTI/tree/main/20240627_macOS_PoseidonStealer
→https://redcanary.com/blog/threat-intelligence/atomic-odyssey-poseidon-stealers/
→https://www.malwarebytes.com/blog/news/2024/06/poseidon-mac-stealer-distributed-via-google-ads
→https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/2024/poseidon_bericht.html

Quick Facts

TypeAPT / Threat Group
Aliases3

Also Known As

osx.poseidonstealerPoseidon StealerRodrigo Stealer

External Intelligence

Malpedia: osx.poseidonstealer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Poseidon Stealer
Poseidon Stealer — APT / Threat Group | Threat Intelligence | CTIWATCH.COM