Odyssey Stealer: Technical Analysis of a macOS Infostealer
Executive Summary In mid-July 2026, I obtained a macOS infostealer trojan disguised as a software licensing tool (Patch.app). The sample is a Mach-O universal binary (x86_64 + arm64) that uses a custom xorshift32 PRNG-based XOR cipher to obfuscate 379 embedded strings. Its recovered code targets 14 browsers, 16 software-wallet locations,...
Continue reading