ICMacOS Malware Evolves to Steal Credentials and Provide Persistent Remote Mac Access

ICMacOS malware has grown from a tool that steals passwords and cryptocurrency wallet data into a remote access trojan that can keep attackers connected to infected Macs.

Its newer version adds a live command channel and a startup mechanism, giving criminals access beyond the first round of data theft.

The change raises the stakes for Mac users and businesses. Rather than leaving after collecting saved logins, the malware can remain active, run commands, and collect more information.

Developers face particular risk because stolen cloud keys, SSH credentials, and project secrets can expose systems outside the infected device.

Researchers from SOCRadar’s Threat Research Unit identified ICMacOS, also called Icarus macOS, in September 2026.

Their October 12 report describes two versions: an initial information stealer and a newer build with persistent remote access. The malware is promoted by a Russian-speaking actor using the name GlowComa.

ICMacOS Malware Evolves

GlowComa advertises ICMacOS on Russian-speaking cybercrime forums, including XSS, Exploit.in, and Rehub, with updates shared through Telegram. Prices start at $699 weekly and reach $1,699 monthly.

Buyers receive a management panel for tracking infected devices, stolen passwords, cookies, files, and wallets, alongside Telegram alerts when stolen data arrives. The panel is written in Go and uses MySQL to store records, giving buyers a central view of stolen assets.

The infection starts with ClickFix pages that persuade victims to paste malicious commands into Terminal. This approach also appears in macOS ClickFix credential theft campaigns, where fake verification prompts turn the user into the trigger for malware execution.

ICMacOS uses an initial Bash script to retrieve a campaign-specific dropper. That dropper changes Terminal preferences to hide window details, then uses AppleScript to display a fake “System Preferences” password dialog.

It checks the supplied password by trying to unlock the user’s login Keychain, allowing up to five attempts. A successful check gives the malware a verified password for later theft.

Next, the script checks whether the Mac uses Intel or Apple Silicon and downloads the matching payload. It launches the malware in the background with the stolen password and campaign details as arguments.

Finally, it closes Terminal and displays a fake error message based on settings retrieved from its server. The developer claims support from macOS Sierra onward, but the report does not establish compatibility with every release.

The main payload is a 64-bit Mach-O executable written in Go. Version 1 checks Russian language settings and the device’s public IP country before stealing data.

The researchers describe this as a guardrail intended to avoid Russia and Commonwealth of Independent States countries, consistent with the operator’s advertised restrictions.

Its collection modules target browser passwords, cookies, history, cryptocurrency wallets, and password manager data. Developer files include AWS credentials, Kubernetes settings, SSH keys, Git credentials, and environment files.

Similar developer credential theft risks have appeared in other Mac campaigns, showing how one compromised workstation can expose a company’s wider infrastructure.

ICMacOS also copies messaging data from Telegram, WhatsApp, Discord, and Apple Messages, plus Apple Notes and Termius information.

It attempts to decrypt Keychain contents using the captured password and an embedded Go library. If that fails, it uses Apple’s security utility, with additional fake prompts seeking administrator approval where needed.

Collected files are packed into a hidden ZIP archive and uploaded through an HTTPS request. A separate Python payload broadens collection to VPN profiles, Slack, Signal, Zoom, and documents in common user folders. It also converts browser cookies into a format that attackers can reuse for session hijacking.

Persistent Remote Access Changes the Risk

Version 2 adds checks for existing malware processes and available privileges before setting up persistence. It installs a LaunchAgent with an Apple-like name and loads it into the active user session.

Its configuration keeps the process running and includes a 60-minute fallback interval, helping restore access if execution stops. The new build also opens a persistent WebSocket connection using the Gorilla WebSocket library.

Commands received from the server run through the Unix shell, with output returned in real time. This move resembles Atomic Stealer backdoor capabilities that extended another Mac credential stealer into a longer-lived remote access threat.

Version 2 further collects clipboard text, Outlook data, Steam files, browser autofill records, and shell history. Defenders should investigate unexpected password dialogs, suspicious Terminal activity, hidden temporary archives, and newly created LaunchAgents. Suspected devices should be isolated, with exposed credentials reset from a clean system and active sessions reviewed.

Indicators of compromise (IoCs):-

Network Indicators

Type	Indicator	Source context
Domain	escapeai[.]live	Payload delivery, configuration, data upload, and remote commands
Domain	mikoblico[.]xyz	Listed network indicator; specific role not stated
IP address	85.137.253[.]61	Listed network indicator
IP address	45.13.186[.]247	Listed network indicator
URL	hxxps[://]escapeai[.]live/api/build_config	Remote build configuration
URL	hxxps[://]escapeai[.]live/icmacos_run_v2[.]command?t={date}	Dropper download
URL	hxxp[://]escapeai[.]live/loader_v2[.]sh?build={build_name}&owner={owner}	Loader endpoint
URL	hxxps[://]escapeai[.]live/ICMacOs?arch=arm64	Apple Silicon payload
URL	hxxps[://]escapeai[.]live/ICMacOs?arch=amd64	Intel payload
URL	hxxps[://]escapeai[.]live/payload[.]py	Additional Python payload
URL	hxxps[://]escapeai[.]live/upload	Stolen-data upload
WebSocket URL	wss[://]escapeai[.]live/ws?mac_id={hostname}&username={username}	Interactive command-and-control channel

Network indicators and their documented roles are drawn from the supplied report.

SHA-256 Hashes

Type	Source-listed value
SHA-256	5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8
SHA-256	8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a
SHA-256	62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17
SHA-256	857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0
SHA-256	6917505bbdc8efa01ea1a0298eae62a93a57a8c98d3712a69d822dca4a667f05
SHA-256	dca852b53c259641e1782bd9122c5007130614a7a8fd17102400acb4f50f6e94
SHA-256	e7e8ac14aaee970c6d00c6cbb398decc56dfc128974c01bfc8e7acd13a18576e
SHA-256	ec37acd3bd15f50eee2941d5644ca0ee738b36ce4a39e9e08058e35ebc7961fc
SHA-256	fcf9de13ecc70b4fda3998ed7a93849edf86c48767a1a13f32f4a6a631a65ae2
SHA-256	3d4f70172c8f31813e7b37fc1a49bce193663e33c4eb65952bb5aec9d7176826
SHA-256	8b7606bdccdd6ff691db875283fdf5b6b658dd8d4d141b44e07f8f2583ff5604
SHA-256	bc8d70f000e73c0c7a69a2676805190e7109cab59df3e34c5a74d2cb7f13a7e4
SHA-256	a9b21ac0112855b835b5e5850ef167471eff7305d42b3a8104c1961b257a444d
SHA-256	c8136413ad38a1028050f5d508e25267b518c5fdeac80b6442103d1009d8924c
SHA-256	e52855d447d152bb698e565f361161cdc8946183ab09bf3cbea89765a2b5ff31
SHA-256	d9df05a3fb68d302ecf134a1214b609c6ec0a3fb9122907214afac3908b587f4
SHA-256	8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69

All 17 hashes are reproduced from the report’s host-indicator tables.

Additional Host Artifacts

Artifact type	Source-documented value	Purpose
LaunchAgent file	~/Library/LaunchAgents/com.apple.systemupdater.plist	Persistent execution
LaunchAgent label	com.apple.systemupdater	Apple-like process naming
Hidden log	/tmp/.update-helper.log	Dropper execution logging
Hidden log	/tmp/.cache-update.log	Stealer execution logging
Payload archive	/tmp/.update-tmp/ICMacOs.gz	Downloaded compressed payload
Stolen-data archive example	/tmp/.systemd-private-helper.zip	Collected files prepared for upload

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.