macOS Odyssey Stealer SOCKS Binary Creation

Drew Pilarski@barnabysDrew

•updated Aug 22, 2025•2•40

Detects the creation of the 'socks' binary used by the Odyssey Stealer to establish a SOCKS5 proxy for network tunneling on compromised macOS systems. This rule identifies the binary based on specific SHA256 hashes and its filename 'socks'.