Poseidon Stealer

Internal ID: osx.poseidonstealer

aliases

Last seen:Mar 17, 2026

Intelligence Profile

macOS infostealer sold by an individual named Rodrigo4, currently consisting of a disk image containing a Mach-O without app bundle, which when executed spawns osascript executing an AppleScript with the actual infostealer payload. The AppleScript payload will steal files by packing them in a ZIP archive and uploading them to a hardcoded C2 via HTTP.

Threat Analysis

Poseidon Stealer is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://github.com/govcert-ch/CTI/tree/main/20240627_macOS_PoseidonStealer

→https://redcanary.com/blog/threat-intelligence/atomic-odyssey-poseidon-stealers/

→https://www.malwarebytes.com/blog/news/2024/06/poseidon-mac-stealer-distributed-via-google-ads

→https://www.ncsc.admin.ch/ncsc/en/home/aktuell/im-fokus/2024/poseidon_bericht.html

Quick Facts

TypeMalware Family

Aliases1

Also Known As

osx.poseidonstealer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Poseidon Stealer