Skip to content
MalwareWiki

Infostealer

Poseidon Stealer

aka Rodrigo Stealer

macOS infostealer sold by an individual named Rodrigo4, currently consisting of a disk image containing a Mach-O without app bundle, which when executed spawns osascript executing an AppleScript with

Poseidon Stealer, also known as Rodrigo Stealer, is a macOS infostealer.

Background

A macOS infostealer marketed by someone using the handle Rodrigo4. At present it arrives as a disk image holding a Mach-O binary with no app bundle; running it launches osascript to execute an AppleScript that carries the real infostealer payload. That AppleScript gathers files into a ZIP archive and sends them over HTTP to a hardcoded C2.

Source: Malpedia (Fraunhofer FKIE).