A recent investigation revealed a sophisticated cyber threat involving the Odyssey macOS stealer panels, particularly highlighting a backdoored version that exfiltrates operator credentials without their knowledge. Security researchers tracked two panels operating on the same Kazakhstan subnet, discovering that one, specifically at the IP address 86.54.25.202, contains a 960-byte credential harvester embedded within its JavaScript bundle. This malicious addition intercepts the operator's login details each time they authenticate, sending the stolen credentials to a receiver at http://scan-tron.link. Meanwhile, the other panel at 86.54.25.204 is uninfected, running a slightly newer software version