ICMacOS Infostealer Evolves Into a Persistent macOS RAT
Summary
SOCRadar details ICMacOS, a macOS MaaS stealer promoted by GlowComa that uses ClickFix delivery to steal credentials and data. Version 2 adds LaunchAgent persistence and interactive WebSocket shell access.
Key points
- SOCRadar identified ICMacOS in September 2026; the MaaS stealer is advertised by the financially motivated actor GlowComa.
- ClickFix pages prompt victims to run terminal commands. A Bash dropper uses a fake system dialog to capture and validate the macOS login password before downloading the payload.
- The malware targets browser credentials and sessions, Keychain data, crypto wallets, messaging applications, developer secrets, and local files.
- Version 2 installs a LaunchAgent for persistence and uses a WebSocket connection to execute operator commands through /bin/sh.
- A supplementary Python payload expands collection to VPN configurations, Slack, Signal, Zoom, and documents.
- The report identifies hxxps://escapeai[.]live as a delivery, exfiltration, and C2 domain, and lists mikoblico[.]xyz as another indicator.
Article Details
- Attack Vectors
- ClickFix social-engineering pages trick victims into running copy-and-paste terminal commands.
- A Bash script downloads and executes a dropper, which uses spoofed macOS system dialogs to capture the victim's login password.
- The dropper downloads an architecture-specific ICMacOS payload and launches it in the background.
- Version 2 installs a LaunchAgent for persistence and uses a WebSocket connection to receive commands and return shell output.
- Defensive Notes
- Check for the LaunchAgent file ~/Library/LaunchAgents/com.apple.systemupdater.plist.
- Look for the hidden log files /tmp/.update-helper.log and /tmp/.cache-update.log, and hidden ZIP archives in /tmp.
- Monitor for network traffic to the listed ICMacOS domains and URLs.
- The article identifies developer secrets, including SSH keys, cloud configurations, Kubernetes credentials, and .env files, as collection targets.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | escapeai[.]live | ICMacOS payload delivery, command-and-control, and data-exfiltration infrastructure. |
| DOMAIN | mikoblico[.]xyz | Listed as an ICMacOS login network indicator. |
| IPV4 | 45[.]13[.]186[.]247 | Listed as an ICMacOS login network indicator. |
| IPV4 | 85[.]137[.]253[.]61 | Listed as an ICMacOS login network indicator. |
| SHA256 | 3d4f70172c8f31813e7b37fc1a49bce193663e33c4eb65952bb5aec9d7176826 | SHA-256 hash identified for an ICMacOS dropper. |
| SHA256 | 5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8 | SHA-256 hash identified for an ICMacOS dropper. |
| SHA256 | 62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17 | SHA-256 hash identified for an ICMacOS dropper. |
| SHA256 | 6917505bbdc8efa01ea1a0298eae62a93a57a8c98d3712a69d822dca4a667f05 | SHA-256 hash identified for an ICMacOS dropper. |
| SHA256 | 857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0 | SHA-256 hash identified for an ICMacOS dropper. |
| SHA256 | 8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69 | SHA-256 hash identified for the ICMacOS Python payload. |
| SHA256 | 8b7606bdccdd6ff691db875283fdf5b6b658dd8d4d141b44e07f8f2583ff5604 | SHA-256 hash identified for an ICMacOS dropper. |
| SHA256 | 8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a | SHA-256 hash identified for an ICMacOS dropper. |
| SHA256 | a9b21ac0112855b835b5e5850ef167471eff7305d42b3a8104c1961b257a444d | SHA-256 hash identified for an ICMacOS Mach-O Version 1 sample. |
| SHA256 | bc8d70f000e73c0c7a69a2676805190e7109cab59df3e34c5a74d2cb7f13a7e4 | SHA-256 hash identified for an ICMacOS Mach-O Version 1 sample. |
| SHA256 | c8136413ad38a1028050f5d508e25267b518c5fdeac80b6442103d1009d8924c | SHA-256 hash identified for an ICMacOS Mach-O Version 1 sample. |
| SHA256 | d9df05a3fb68d302ecf134a1214b609c6ec0a3fb9122907214afac3908b587f4 | SHA-256 hash identified for an ICMacOS Mach-O Version 2 sample. |
| SHA256 | dca852b53c259641e1782bd9122c5007130614a7a8fd17102400acb4f50f6e94 | SHA-256 hash identified for an ICMacOS dropper. |
| SHA256 | e52855d447d152bb698e565f361161cdc8946183ab09bf3cbea89765a2b5ff31 | SHA-256 hash identified for an ICMacOS Mach-O Version 2 sample. |
| SHA256 | e7e8ac14aaee970c6d00c6cbb398decc56dfc128974c01bfc8e7acd13a18576e | SHA-256 hash identified for an ICMacOS dropper. |
| SHA256 | ec37acd3bd15f50eee2941d5644ca0ee738b36ce4a39e9e08058e35ebc7961fc | SHA-256 hash identified for an ICMacOS dropper. |
| SHA256 | fcf9de13ecc70b4fda3998ed7a93849edf86c48767a1a13f32f4a6a631a65ae2 | SHA-256 hash identified for an ICMacOS dropper. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collects local wallet data, developer credentials, messaging data, and other files.T1033 · System Owner/User DiscoveryVersion 2 checks whether it is running as root or whether the user belongs to the wheel group.T1036.005 · Match Legitimate Resource Name or LocationThe LaunchAgent label com.apple.systemupdater imitates an Apple system process.T1056.002 · GUI Input CaptureSpoofed System Preferences dialogs prompt victims to enter their macOS login password.T1057 · Process DiscoveryVersion 2 uses pgrep to enumerate running ICMacOS processes before terminating existing instances.T1059.002 · AppleScriptosascript launches fake password dialogs, runs background processes, and invokes commands with administrator privileges.T1059.004 · Unix ShellBash scripts perform initial dropping, setup, and payload execution.T1059.006 · PythonA supplementary Python payload searches for sensitive files, VPN configurations, and session data.T1071.001 · Web ProtocolsVersion 2 uses a persistent WebSocket connection for interactive command-and-control.T1082 · System Information DiscoveryThe malware gathers system, hardware, display, and operating-system information.T1083 · File and Directory DiscoveryICMacOS recursively searches directories for credential files and other targeted data.T1115 · Clipboard DataVersion 2 captures clipboard text using pbpaste.T1119 · Automated CollectionICMacOS iterates over configured browser-extension IDs and collects their local storage data.T1204.004 · Malicious Copy and PasteClickFix pages trick victims into executing the malware through copy-and-paste terminal commands.T1480 · Execution GuardrailsThe malware stops execution when locale or IP geolocation checks indicate a CIS country.T1543.001 · Launch AgentVersion 2 installs a LaunchAgent plist and registers it in the user GUI session for persistence.T1548 · Abuse Elevation Control MechanismICMacOS uses AppleScript commands requesting administrator privileges to dump restricted Keychain records.T1552.001 · Credentials In FilesThe malware searches for credentials in .env files, SSH and cloud configuration files, and other local files.T1552.003 · Shell HistoryICMacOS collects shell and REPL history files that may contain passwords, keys, and tokens.T1555.001 · KeychainICMacOS extracts Keychain data using keychainbreaker and the security dump-keychain utility.T1555.003 · Credentials from Web BrowsersThe stealer collects browser login data, cookies, and browser decryption keys.T1555.005 · Password ManagersICMacOS collects local storage and database files from named password managers.T1560 · Archive Collected DataICMacOS compresses collected artifacts into a ZIP archive before exfiltration.T1564 · Hide ArtifactsThe dropper alters Terminal preferences to hide window titles, process names, and headers.
Threat Actors
Malware
Atomic macOS Stealer (AMOS)Lowering the barrier to entry for novice and sophisticated threat actors alike, the Malware-as-a-Service (MaaS) model has accelerated the spread of specialized stealers like AMOS, MacSync, and Cthulhu.CthulhuLowering the barrier to entry for novice and sophisticated threat actors alike, the Malware-as-a-Service (MaaS) model has accelerated the spread of specialized stealers like AMOS, MacSync, and Cthulhu.ICMacOSInside ICMacOS: From an Infostealer to a Persistent RATMacSyncLowering the barrier to entry for novice and sophisticated threat actors alike, the Malware-as-a-Service (MaaS) model has accelerated the spread of specialized stealers like AMOS, MacSync, and Cthulhu.