Odyssey Stealer & AMOS Hit macOS Developers with Fake Homebrew Sites

This report documents an active, coordinated campaign targeting macOS developers using fake download portals and clipboard-based social engineering to trick victims into pasting base64-encoded curl commands that install Odyssey Stealer or AMOS; investigators identified 85+ phishing domains, reused SSL certificates and multi-year infrastructure (notably IPs 93.152.230.79 and 195.82.147.38), analyzed payload behavior (privilege escalation attempts, anti-analysis, service manipulation, and credential/crypto theft), and provided IOCs and mitigations.