From Drained Wallet to Threat Actor: A DFIR Investigation into ClickFix and Odyssey Stealer

Odyssey is a Malware-as-a-Service platform, and that changes how DFIR works. Developers host the infrastructure; affiliates pay for access and run their own campaigns. The affiliate who set the trap is a different actor from the operators running the backend, and attribution requires untangling both. This talk shows how. Using forensic artifacts on the endpoint, network telemetry, and internet-wide scan data to identify the affiliate, map the full C2 fleet, and trace the platform's lineage from AMOS through Poseidon to Odyssey. The case that gets us there: a user reports their cryptocurrency wallet has been drained. The Ledger Live app on their Mac "looked totally normal." Working a real incident from first call to final attribution, we trace Odyssey Stealer -- a macOS infostealer -- from the hidden LaunchDaemon on the victim's machine all the way back to the threat actor who ran the campaign. The path runs through a trojanized Ledger app, a cleartext password cached in a dotfile, a ClickFix fake CAPTCHA page the victim visited two weeks before the theft, and a polished React admin panel hosted on ten C2 servers across Europe and Russia. Attendees leave with a concrete forensic artifact reference for Odyssey infections, a repeatable methodology for hunting MaaS C2 infrastructure from a single known host, and a clear-eyed picture of what "attribution" means when you're investigating a criminal SaaS.