Macos Odyssey Infostealer Temp File Execution

Drew Pilarski@barnabysDrew

•updated Aug 22, 2025•2•20

Detects a file being created in a temporary macOS directory, made executable, and then executed by a shell. This behavior is consistent with the Odyssey Infostealer, which downloads and runs scripts from temporary locations.