ICMacOS Malware Steals Credentials, Grants Persistent Remote Access
Key Takeaways ICMacOS malware has evolved from a basic information stealer to a persistent Remote Access Trojan (RAT) targeting macOS systems. The updated malware, also known as Icarus macOS, now...
Key Takeaways
- ICMacOS malware has evolved from a basic information stealer to a persistent Remote Access Trojan (RAT) targeting macOS systems.
- The updated malware, also known as Icarus macOS, now includes a live command channel and a robust startup mechanism, enabling prolonged access to compromised Macs.
- Attackers leverage fake system prompts and “ClickFix” social engineering tactics to trick users into executing malicious commands in Terminal.
- The malware is actively advertised on Russian-speaking cybercrime forums, with subscription models ranging from $699 weekly to $1,699 monthly.
- Beyond standard credentials, ICMacOS specifically targets developer-related files like AWS keys, SSH credentials, and Kubernetes settings, posing a significant risk to organizational infrastructure.
The ICMacOS malware, also known as Icarus macOS, has undergone a significant evolution, transforming from a straightforward credential and cryptocurrency wallet stealer into a sophisticated remote access trojan (RAT). This development grants attackers persistent control over infected Apple Mac devices, moving beyond initial data exfiltration to establish a long-term presence.
Table Of Content
The latest iteration of ICMacOS incorporates a live command-and-control (C2) channel and a new persistence mechanism. This allows threat actors to maintain access to compromised systems, execute arbitrary commands, and continuously harvest sensitive information, dramatically escalating the threat posed to Mac users and enterprises.
For developers, the risks are particularly acute. The malware is designed to exfiltrate critical assets such as cloud keys, SSH credentials, and project secrets. A breach on a single developer workstation could potentially compromise broader organizational infrastructure, highlighting the far-reaching implications of this threat.
Researchers from SOCRadar’s Threat Research Unit identified ICMacOS in September 2026. Their comprehensive report, published on October 12, details two distinct versions: an initial information stealer and the more advanced build featuring persistent remote access capabilities. The malware is actively promoted by a Russian-speaking threat actor operating under the alias “GlowComa.”
ICMacOS Malware Evolution and Distribution
GlowComa extensively promotes ICMacOS across prominent Russian-speaking cybercrime forums, including XSS, Exploit.in, and Rehub, with updates disseminated via Telegram. The malware is offered under a subscription model, with weekly access starting at $699 and monthly subscriptions reaching $1,699.
Subscribers gain access to a dedicated management panel, which provides a centralized interface for tracking compromised devices, viewing stolen credentials, cookies, files, and cryptocurrency wallet data. The panel, developed in Go and utilizing MySQL for data storage, also delivers real-time Telegram alerts upon successful data exfiltration.
Infection Chain and Credential Theft
The infection process typically begins with “ClickFix” pages. These malicious web pages employ social engineering tactics to trick victims into pasting harmful commands directly into their Mac’s Terminal application. This method mirrors other macOS ClickFix campaigns where fake verification prompts manipulate users into inadvertently executing malware.
ICMacOS initiates its attack with a Bash script designed to fetch a specific dropper for the campaign. This dropper then modifies Terminal preferences to obscure window details and subsequently employs AppleScript to display a convincing, but fake, “System Preferences” password dialog. The malware attempts to validate the entered password by trying to unlock the user’s login Keychain, allowing up to five attempts. A successful password entry provides the malware with a verified credential for subsequent exploitation.
Following password acquisition, the script identifies whether the target Mac runs on an Intel or Apple Silicon processor and downloads the corresponding payload. The malware then launches silently in the background, using the stolen password and campaign details as arguments. Finally, it closes the Terminal window and displays a fabricated error message, configured from its command-and-control server. The developer claims support for macOS Sierra and newer versions, though the report does not confirm compatibility across all macOS releases.
Data Exfiltration and Geographic Restrictions
The primary payload is a 64-bit Mach-O executable written in Go. The initial version of ICMacOS includes geographic guardrails, checking for Russian language settings and the device’s public IP address to avoid targeting Russia and other Commonwealth of Independent States (CIS) countries. This aligns with the operator’s advertised restrictions.
ICMacOS is designed to harvest an extensive range of sensitive data. Its collection modules target browser passwords, cookies, browsing history, cryptocurrency wallets, and data from password managers. Of particular concern are developer-specific files, including AWS credentials, Kubernetes configurations, SSH keys, Git credentials, and environment variables. This focus on developer assets underscores how a single compromised workstation can serve as a gateway to an organization’s broader infrastructure, a risk observed in other macOS campaigns targeting developers.
Furthermore, ICMacOS extracts messaging data from applications such as Telegram, WhatsApp, Discord, and Apple Messages, alongside Apple Notes and Termius information. The malware attempts to decrypt Keychain contents using the initially captured password and an embedded Go library. If this method fails, it leverages Apple’s built-in security utility, often displaying additional fake prompts to solicit administrator approval.
All collected files are compressed into a hidden ZIP archive and uploaded to the C2 server via an HTTPS request. An additional Python payload expands the data collection to include VPN profiles, Slack, Signal, Zoom, and documents found in common user directories. This payload also converts browser cookies into a format suitable for session hijacking, enabling attackers to bypass traditional authentication methods.
Persistent Remote Access Changes the Risk
The updated Version 2 of ICMacOS introduces robust persistence mechanisms. Before establishing persistence, it checks for existing malware processes and evaluates available user privileges. It then installs a LaunchAgent with a deceptive, Apple-like name, such as com.apple.systemupdater.plist, and loads it into the active user session.
The LaunchAgent configuration ensures continuous execution of the malware and includes a 60-minute fallback interval, designed to re-establish access if the process is terminated. This new build also establishes a persistent WebSocket connection using the Gorilla WebSocket library.
Commands received from the C2 server are executed through the Unix shell, with real-time output streamed back to the attackers. This persistent backdoor functionality mirrors capabilities seen in other macOS threats, such as Atomic Stealer, which similarly evolved from an infostealer to a long-term remote access threat.
Version 2 further expands its data collection to include clipboard text, Outlook data, Steam files, browser autofill records, and shell history. Defenders must remain vigilant for any unusual password dialogs, suspicious Terminal activity, hidden temporary archives, and newly created LaunchAgents.
What You Should Do
- Educate Users: Train users to recognize and avoid “ClickFix” social engineering tactics, especially prompts asking to paste commands into Terminal or enter system passwords.
- Implement Endpoint Detection and Response (EDR): Deploy robust EDR solutions capable of detecting unusual process activity, unauthorized file modifications, and suspicious network connections.
- Monitor for Suspicious Activity: Regularly review system logs for unexpected password dialogs, unusual Terminal commands, the creation of hidden temporary archives (e.g.,
/tmp/.systemd-private-helper.zip), and newly installed LaunchAgents (e.g.,~/Library/LaunchAgents/com.apple.systemupdater.plist). - Practice Principle of Least Privilege: Limit user and application privileges to the minimum necessary for their functions, especially for developer accounts which often hold highly sensitive credentials.
- Isolate and Remediate: Immediately isolate any suspected compromised devices. Reset all exposed credentials from a known clean system and review all active user sessions for unauthorized activity.
- Secure Developer Workstations: Implement enhanced security measures for developer environments, including strict access controls for cloud keys, SSH credentials, and source code repositories.
- Network Filtering: Block access to the identified malicious domains and IP addresses at the network perimeter.
Indicators of Compromise (IoCs)
Network Indicators
| Type | Indicator | Source context |
|---|---|---|
| Domain | escapeai[.]live |
Payload delivery, configuration, data upload, and remote commands |
| Domain | mikoblico[.]xyz |
Listed network indicator; specific role not stated |
| IP address | 85.137.253[.]61 |
Listed network indicator |
| IP address | 45.13.186[.]247 |
Listed network indicator |
| URL | hxxps[://]escapeai[.]live/api/build_config |
Remote build configuration |
| URL | hxxps[://]escapeai[.]live/icmacos_run_v2[.]command?t={date} |
Dropper download |
| URL | hxxp[://]escapeai[.]live/loader_v2[.]sh?build={build_name}&owner={owner} |
Loader endpoint |
| URL | hxxps[://]escapeai[.]live/ICMacOs?arch=arm64 |
Apple Silicon payload |
| URL | hxxps[://]escapeai[.]live/ICMacOs?arch=amd64 |
Intel payload |
| URL | hxxps[://]escapeai[.]live/payload[.]py |
Additional Python payload |
| URL | hxxps[://]escapeai[.]live/upload |
Stolen-data upload |
| WebSocket URL | wss[://]escapeai[.]live/ws?mac_id={hostname}&username={username} |
Interactive command-and-control channel |
The network indicators and their documented roles are sourced from the original report found here.
SHA-256 Hashes
| Type | Source-listed value |
|---|---|
| SHA-256 | 5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8 |
| SHA-256 | 8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a |
| SHA-256 | 62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17 |
| SHA-256 | 857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0 |
| SHA-256 | 6917505bbdc8efa01ea1a0298eae62a93a57a8c98d3712a69d822dca4a667f05 |
| SHA-256 | dca852b53c259641e1782bd9122c5007130614a7a8fd17102400acb4f50f6e94 |
| SHA-256 | e7e8ac14aaee970c6d00c6cbb398decc56dfc128974c01bfc8e7acd13a18576e |
| SHA-256 | ec37acd3bd15f50eee2941d5644ca0ee738b36ce4a39e9e08058e35ebc7961fc |
| SHA-256 | fcf9de13ecc70b4fda3998ed7a93849edf86c48767a1a13f32f4a6a631a65ae2 |
No Comment! Be the first one.