macOS AMOS/Odyssey Stealer XPC Service Interaction

Duo Tech@duotech

•updated Oct 21, 2025•2•0•87

Detects the interaction with macOS XPC services such as 'nsurlstoraged' and 'CoreSpotlightService' via 'xpcproxy'. This technique is used by malware like AMOS and Odyssey Stealer to blend malicious activity with legitimate system processes for stealth and persistence.