Hackers Exploit Fake Microsoft Teams Site to Spread Odyssey macOS Stealer

Hackers have set up a fraudulent Microsoft Teams download site, hosted at teamsonsoft[.]com, to distribute the Odyssey macOS stealer, a campaign that researchers say uses a “clickfix” approach to exploit user trust in legitimate software. The campaign first came to light in early August 2025, with Forcepoint documenting attacks using fake TradingView sites before expanding to impersonate Microsoft Teams; researchers identified 24 unique IP addresses belonging to the same malicious infrastructure cluster.

When macOS users visit the page and copy a provided command into Terminal, the base64-encoded payload decodes to an AppleScript-based stealer that harvests data without relying on software exploits.

The Odyssey stealer targets credentials, Chrome keychain items, cryptocurrency assets across wallets and extensions, and even replaces legitimate Ledger Live apps with trojanised versions to intercept transactions, storing stolen data in a ZIP archive before exfiltration to the attacker’s C2 server at IP address 185.93.89[.]62.

According to Forcepoint, the operation continues to evolve as the same threat actors expand from trading-platform impersonation to Microsoft Teams phishing, underscoring the need for cautious software download habits and robust endpoint detection.