ICMacOS malware sells for $699 weekly, stealing Mac data while adding stealth, persistence, and remote command execution.

ICMacOSの名称で販売されているmacOS向け情報窃取マルウェア「Icarus」が、単なる「盗んで逃げる」型から進化しました。最新版は永続化の仕組みを導入し、攻撃者との常時接続を維持したうえで、リモートサーバーから送られたコマンドを実行します。 SOCRadarは2026年9月にICMacOSを確認し、2つの亜種

Apple製コンピュータを狙うマルウェアファミリー「ICMacOS」が、情報窃取型から永続化機能を備えたリモートアクセス型トロイの木馬（RAT）へと進化しました。 更新版のマルウェアは、パスワードや暗号資産ウォレットのデータ、機密ファイルを引き続き収集しながら、感染したMac上で攻撃者がコマンドを実行できるようになっ

En septembre 2026, la SOCRadar Threat Research Unit (STRU) a identifié ICMacOS (alias Icarus macOS), un nouveau malware macOS distribué sous modèle MaaS (Malware-as-a-Service), activement promu sur des forums cybercriminels russophones par l'acteur GlowComa. L'analyse technique complète a été publiée le 12 octobre 2026.

ICMacOS malware has grown from a tool that steals passwords and cryptocurrency wallet data into a remote access trojan that can keep attackers connected to infected Macs. Its newer version adds a liv…

Blog sobre informática, tecnología y seguridad con manuales, tutoriales y documentación sobre herramientas y programas

ICMacOS malware has grown from a tool that steals passwords and cryptocurrency wallet data into a remote access trojan that can keep attackers connected to infected Macs. Its newer version adds a live command channel and a startup mechanism, giving criminals access beyond the first round of data theft. The change raises the stakes for Mac users and businesses. Rather than leaving after collecting saved logins, the malware can remain active, run commands, and collect more information. Developers face particular risk because stolen cloud keys, SSH credentials, and project secrets can expose systems outside the infected device. Researchers from SOCRadar’s Threat Research Unit identified ICMacOS, also called Icarus macOS, in September 2026. Their October 12 report describes two versions: an initial information stealer and a newer build with persistent remote access. The malware is promoted by a Russian-speaking actor using the name GlowComa. ICMacOS Malware Evolves GlowComa advertises ICMacOS on Russian-speaking cybercrime forums, including XSS, Exploit.in, and Rehub, with updates shared through Telegram. Prices start at $699 weekly and reach $1,699 monthly. Buyers receive a management panel for tracking infected devices, stolen passwords, cookies, files, and wallets, alongside Telegram alerts when stolen data arrives. The panel is written in Go and uses MySQL to store records, giving buyers a central view of stolen assets. ICMacOS Dropper Default Fake System Dialog (Source – SOCRadar) The infection starts with ClickFix pages that persuade victims to paste malicious commands into Terminal. This approach also appears in macOS ClickFix credential theft campaigns, where fake verification prompts turn the user into the trigger for malware execution. ICMacOS uses an initial Bash script to retrieve a campaign-specific dropper. That dropper changes Terminal preferences to hide window details, then uses AppleScript to display a fake “System Preferences” password dialog. It checks the supplied password by trying to unlock the user’s login Keychain, allowing up to five attempts. A successful check gives the malware a verified password for later theft. Next, the script checks whether the Mac uses Intel or Apple Silicon and downloads the matching payload. It launches the malware in the background with the stolen password and campaign details as arguments. Finally, it closes Terminal and displays a fake error message based on settings retrieved from its server. The developer claims support from macOS Sierra onward, but the report does not establish compatibility with every release. The main payload is a 64-bit Mach-O executable written in Go. Version 1 checks Russian language settings and the device’s public IP country before stealing data. The researchers describe this as a guardrail intended to avoid Russia and Commonwealth of Independent States countries, consistent with the operator’s advertised restrictions. Its collection modules target browser passwords, cookies, history, cryptocurrency wallets, and password manager data. Developer files include AWS credentials, Kubernetes settings, SSH keys, Git credentials, and environment files. ICMacOS Custom Fake Error Parsing (Source – SOCRadar) Similar developer credential theft risks have appeared in other Mac campaigns, showing how one compromised workstation can expose a company’s wider infrastructure. ICMacOS also copies messaging data from Telegram, WhatsApp, Discord, and Apple Messages, plus Apple Notes and Termius information. It attempts to decrypt Keychain contents using the captured password and an embedded Go library. If that fails, it uses Apple’s security utility, with additional fake prompts seeking administrator approval where needed. Collected files are packed into a hidden ZIP archive and uploaded through an HTTPS request. A separate Python payload broadens collection to VPN profiles, Slack, Signal, Zoom, and documents in common user folders. It also converts browser cookies into a format that attackers can reuse for session hijacking. Persistent Remote Access Changes the Risk Version 2 adds checks for existing malware processes and available privileges before setting up persistence. It installs a LaunchAgent with an Apple-like name and loads it into the active user session. Its configuration keeps the process running and includes a 60-minute fallback interval, helping restore access if execution stops. The new build also opens a persistent WebSocket connection using the Gorilla WebSocket library. ICMacOS com.apple.systemupdater.plist File (Source – SOCRadar) Commands received from the server run through the Unix shell, with output returned in real time. This move resembles Atomic Stealer backdoor capabilities that extended another Mac credential stealer into a longer-lived remote access threat. Version 2 further collects clipboard text, Outlook data, Steam files, browser autofill records, and shell history. Defenders should investigate unexpected password dialogs, suspicious Terminal activity, hidden temporary archives, and newly created LaunchAgents. Suspected devices should be isolated, with exposed credentials reset from a clean system and active sessions reviewed. Indicators of compromise (IoCs):- Network Indicators Type Indicator Source context Domain escapeai[.]live Payload delivery, configuration, data upload, and remote commands Domain mikoblico[.]xyz Listed network indicator; specific role not stated IP address 85.137.253[.]61 Listed network indicator IP address 45.13.186[.]247 Listed network indicator URL hxxps[://]escapeai[.]live/api/build_config Remote build configuration URL hxxps[://]escapeai[.]live/icmacos_run_v2[.]command?t={date} Dropper download URL hxxp[://]escapeai[.]live/loader_v2[.]sh?build={build_name}&owner={owner} Loader endpoint URL hxxps[://]escapeai[.]live/ICMacOs?arch=arm64 Apple Silicon payload URL hxxps[://]escapeai[.]live/ICMacOs?arch=amd64 Intel payload URL hxxps[://]escapeai[.]live/payload[.]py Additional Python payload URL hxxps[://]escapeai[.]live/upload Stolen-data upload WebSocket URL wss[://]escapeai[.]live/ws?mac_id={hostname}&username={username} Interactive command-and-control channel Network indicators and their documented roles are drawn from the supplied report. SHA-256 Hashes Type Source-listed value SHA-256 5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8 SHA-256 8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a SHA-256 62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17 SHA-256 857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0 SHA-256 6917505bbdc8efa01ea1a0298eae62a93a57a8c98d3712a69d822dca4a667f05 SHA-256 dca852b53c259641e1782bd9122c5007130614a7a8fd17102400acb4f50f6e94 SHA-256 e7e8ac14aaee970c6d00c6cbb398decc56dfc128974c01bfc8e7acd13a18576e SHA-256 ec37acd3bd15f50eee2941d5644ca0ee738b36ce4a39e9e08058e35ebc7961fc SHA-256 fcf9de13ecc70b4fda3998ed7a93849edf86c48767a1a13f32f4a6a631a65ae2 SHA-256 3d4f70172c8f31813e7b37fc1a49bce193663e33c4eb65952bb5aec9d7176826 SHA-256 8b7606bdccdd6ff691db875283fdf5b6b658dd8d4d141b44e07f8f2583ff5604 SHA-256 bc8d70f000e73c0c7a69a2676805190e7109cab59df3e34c5a74d2cb7f13a7e4 SHA-256 a9b21ac0112855b835b5e5850ef167471eff7305d42b3a8104c1961b257a444d SHA-256 c8136413ad38a1028050f5d508e25267b518c5fdeac80b6442103d1009d8924c SHA-256 e52855d447d152bb698e565f361161cdc8946183ab09bf3cbea89765a2b5ff31 SHA-256 d9df05a3fb68d302ecf134a1214b609c6ec0a3fb9122907214afac3908b587f4 SHA-256 8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69 All 17 hashes are reproduced from the report’s host-indicator tables. Additional Host Artifacts Artifact type Source-documented value Purpose LaunchAgent file ~/Library/LaunchAgents/com.apple.systemupdater.plist Persistent execution LaunchAgent label com.apple.systemupdater Apple-like process naming Hidden log /tmp/.update-helper.log Dropper execution logging Hidden log /tmp/.cache-update.log Stealer execution logging Payload archive /tmp/.update-tmp/ICMacOs.gz Downloaded compressed payload Stolen-data archive example /tmp/.systemd-private-helper.zip Collected files prepared for upload Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs . The post ICMacOS Malware Evolves to Steal Credentials and Provide Persistent Remote Mac Access appeared first on Cyber Security News .

ICMacOS evolves into a persistent Mac RAT, stealing credentials and crypto data while enabling remote commands and ongoing espionage.

Die Bedrohungsanalysten der SOCRadar Threat Research Unit haben im September 2026 eine neue Schadsoftware namens ICMacOS beziehungsweise Icarus macOS identifiziert. Hinter dem Programm steht der russischsprachige Akteur GlowComa, der die Software nach dem Modell Malware-as-a-Service vertreibt. Nach Erkenntnissen der Sicherheitsforscher hat sich die Bedrohung von einem reinen Werkzeug zum Diebstahl vertraulicher Daten (Version 1) zu […] The post ICMacOS: Neue Mac-Malware stiehlt Zugangsdaten und ermöglicht Fernzugriff appeared first on BornCity.

SOCRadar's Threat Research Unit identificeerde in september 2026 de malware ICMacOS, ook bekend als Icarus macOS. Deze evolueerde van een tool voor het stelen van wachtwoorden en cryptocurrency wallet-gegevens naar een geavanceerde remote access trojan. De malafide software wordt gepromoot door een Russischsprekende actor genaamd GlowComa, die ICMacOS adverteert op cybercriminele forums zoals XSS, Exploit.in en Rehub. Updates worden gedeeld via Telegram. De prijzen voor de malware variëren van $699 per week tot $1.699 per maand. Kopers van ICMacOS ontvangen een beheerpaneel, ontwikkeld in Go, dat MySQL gebruikt voor databeheer. Dit paneel biedt een overzicht van geïnfecteerde apparaten, ges...

SOCRadar researchers have just published a new analysis of ICMacOS (also marketed as Icarus macOS), a Malware-as-a-Service infostealer for macOS that has been actively advertised on Russian-speaking cybercrime forums, including XSS, Exploit.in, and Rehub, since early September 2026. Key findings include: Rapid evolution: Within weeks of its public launch, ICMacOS moved from one-shot credential and wallet theft to a persistent remote access trojan, adding LaunchAgent persistence and a live WebSocket-based shell that lets operators run commands on infected Macs in real time…

macOSを狙う新たなマルウェア・アズ・ア・サービス（MaaS）「ICMacOS」が、Appleの偽のシステムダイアログを使ってログインパスワードを盗み取り、その後、情報窃取型マルウェアを展開します。この情報窃取型マルウェアは、永続的に居座るリモートアクセス型トロイの木馬（RAT）へと進化しています。 運営者は、この