ICMacOS Malware Evolves Into Remote Access Trojan That Lets Hackers Control Infected Macs - Cyber Press
ICMacOS, a malware targeting Apple computers, has evolved from an information stealer into a persistent remote access trojan that lets hackers control infected devices.
SOCRadar identified ICMacOS, also called Icarus macOS, in September 2026. The malware's October 12 report details two versions: an initial payload focused on data theft and a second version adding interactive remote control capabilities that persist across system reboots.
A Russian-speaking threat actor using the name GlowComa advertises the malware on XSS, Exploit.in, and Rehub. Operating under the MADHASH crypto-draining group's banner, the actor bundles ICMacOS with an Icarus ClickFix panel and cryptocurrency clipper.
Delivery Method
ICMacOS spreads through ClickFix pages that persuade victims to paste malicious commands into Terminal. Rather than exploiting a confirmed software vulnerability, this delivery method relies on users following deceptive instructions.
The first Bash script downloads a dropper, which changes Terminal preferences to hide visible execution details. It then uses AppleScript to display a fake System Preferences password request, with up to five attempts allowed against the victim's login Keychain.
Functionality
The malware targets browser credentials, cookies, password manager files, cryptocurrency wallets, messaging data, and local documents. It also collects developer assets including SSH keys, AWS credentials, Kubernetes configurations, and Git credentials.
The enterprise risk extends beyond stolen personal passwords. Exposed developer secrets can provide a pathway into cloud services, source code, and company infrastructure.
Version 2 installs a LaunchAgent with an Apple-like name to blend with legitimate components. The malware opens a WebSocket connection to escapeai[.]live, giving attackers an interactive shell alongside theft functions.
Related
