Active threat familymacOSCredential theft
Malware Intelligence

Poseidon Stealer

Poseidon is a macOS infostealer sold by a person named "Rodrigo4". A Mach-O file in the disk image runs, through osascript, the AppleScript that carries the main payload; files are placed in a ZIP archive and uploaded over HTTP to a fixed C2 address.

Activity map

MalwarebytesRed Canary

Activity mapDownloadExecutionPackagingExfiltrationSponsoredsearch adArc browserFake download siteFake download pageDMGDisk imageosascriptAppleScript payloadPoseidon StealerInfostealerData collection7 targetsLog archiveC2 server
Executable payloadFile
Malicious payloadPoseidon Stealer · Infostealer

Poseidon is a macOS infostealer sold by a person named "Rodrigo4". A Mach-O file in the disk image runs, through osascript, the AppleScript that carries the main payload; files are placed in a ZIP archive and uploaded over HTTP to a fixed C2 address.

Environment information

  • Operating system
  • Hardware
  • IP and location
  • Installed software
  • Desktop files

Credentials and application data

  • Saved passwords
  • Session cookies
  • Autofill
  • Saved cards
  • Keychain
  • Exodus
  • Electrum
  • MetaMask
Dark Radar infection records
7,177
Latest infection record
8 October 2026
Malware type
Infostealer
First seen
2024
01

Overview

Ranks 37 of 52 families in Dark Radar data, with 7,177 infection records.

Other names: Rodrigo Stealer

02

Origin and evolution

  1. June 2024Distributed through fake browser download ads.Malwarebytes
03

Technical profile

Malware typeInfostealer
Target operating systemmacOS
Primary purposeData theft
Threat categoryCredential theft
Programming languageMach-O + AppleScript
Distribution modelSold by "Rodrigo4"
First seen2024
Infected systemsmacOS 91.5%
Public source confidenceMedium
04

Targeted applications

7 applications5 categories
05

Data collection

Credentials

  • Browser passwords99%Verified
  • Session cookies100%Dark Radar observation
  • Refreshing expired sessions—
  • Autofill97.5%Dark Radar observation
  • macOS Keychain53.5%Verified
  • 2FA and password managers—

Financial

  • Saved cards34.5%Dark Radar observation
  • Desktop crypto walletsVerified
  • Wallet extensions—
  • Clipboard address replacement—

Applications

  • Email clients—
  • FTP clients—
  • VPN clientsReported
  • Messaging applications—
  • Gaming platforms—

System

  • File collectionVerified
  • Screenshot—
  • System inventory100%Dark Radar observation
06

File system

User folder (~)
File details are in Dark Radar IntelligenceOpen in Intelligence
07

How it works

  1. 1Infection

    • Fake application pages promoted with search ads.
    T1189Drive-by Compromise

    Breaking point: Email attachments, sponsored ad links and unlicensed software downloads are blocked at the email and web gateway.

  2. 2Execution and evasion

    • AppleScript payload via osascript; the user is asked for their password.
    T1059.002AppleScript

    Breaking point: Only signed and notarized applications are allowed; processes requesting passwords through osascript are monitored.

  3. 3Discovery

    Dark Radar observation

    Infected systems: macOS 91.5%.

    Breaking point: Bulk system and security software queries from a short-lived process trigger an EDR alert.

  4. 4Data collection

    Dark Radar observation

    Data found in the latest 200 logs: password file 99%, cookies 100%, autofill 97.5%, cards 34.5%.

    T1056.002GUI Input CaptureT1555.001KeychainT1555.003Credentials from Web BrowsersT1560Archive Collected Data

    Breaking point: A process other than the browser reading browser profile files is blocked or triggers an alert.

  5. 5Exfiltration and C2

    • The ZIP archive is uploaded over HTTP to a fixed C2.
    T1071.001Web ProtocolsT1041Exfiltration Over C2 Channel

    Breaking point: Traffic to newly registered domains, direct IP addresses and non-standard ports is blocked.

08

MITRE ATT&CK

Initial Access
Execution
Credential Access
Collection
Command and Control
Exfiltration
09

IOCs and detection

This section is in Dark Radar IntelligenceOpen in Intelligence
10

Risk and impact

  • Stolen session cookies are enough to take over cloud, email and SaaS sessions without a password or multi-factor authentication prompt.
  • Corporate passwords saved on personal devices also leak through infections outside the corporate network; these logs are sold to initial access brokers.
  • Log archives are reshared for years; as long as the password is not changed, the same credential can be used again and again.
  • Compromised email, messaging and social media accounts become the next link in phishing and malware distribution.
11

Defense

  • When an infection is detected, revoke not only the password but all related sessions and access tokens.
  • Turn off password saving in the browser through corporate policy; use a corporate password manager.
  • Move to phishing-resistant multi-factor authentication (FIDO2/passkey); bind sessions to the device.
  • Block setup files downloaded from unlicensed software, game cheats and sponsored search results.
  • Monitor flows where the user runs a command by pasting it into the Run dialog or terminal (ClickFix) with endpoint rules.
  • Continuously monitor your corporate domains and employee email addresses in stealer logs with Dark Radar.
12

Learning center

How does this malware spread?
  • Fake application pages promoted with search ads.
How can its presence on a system be detected?
  • Sign-ins to accounts from an unrecognized country or device.
  • A new infostealer log in Dark Radar for your corporate domain or an employee email address.
Which macOS artifacts should be examined?
  • DMG files under ~/Downloads and the com.apple.quarantine attribute.
  • The user's Terminal history (~/.zsh_history).
  • Temporary ZIP archives under /tmp.
  • New plist files under ~/Library/LaunchAgents.
Which log records matter?
  • Unified log (log show)osascript processes and dialog boxes asking the user for a password.
  • TCC databaseFull Disk Access permission granted to Terminal or an unknown application.
  • Endpoint Security Framework (ESF)Processes accessing the Keychain file and browser profiles.
  • ~/.zshrc, LaunchAgentsLines and plist files added for persistence.
Which MITRE techniques is it associated with?
T1189Drive-by CompromiseT1059.002AppleScriptT1056.002GUI Input CaptureT1555.001KeychainT1555.003Credentials from Web BrowsersT1560Archive Collected DataT1071.001Web ProtocolsT1041Exfiltration Over C2 Channel
How should a SOC analyst respond?
  1. Isolate the device from the network; do not reinstall it before taking memory and disk images.
  2. Determine the infection date; list all accounts that were signed in on the device after that date.
  3. Change the passwords of these accounts, revoke their sessions and access tokens, and re-enroll multi-factor authentication devices.
  4. Search identity provider and SaaS logs for new country, device and token usage after the infection.
  5. If a recovery phrase or wallet file was exposed, move the assets to a new wallet.
  6. Find the initial access path (email, ad, unlicensed software, fake CAPTCHA) and check other users who used the same path.
  7. Reinstall the device from a clean image.
13

Sources

Related terms

Malvertising
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans