ICMacOS Malware Evolves into Persistent Remote Access Trojan for Macs
The ICMacOS malware, also known as Icarus macOS, has been updated by the Russian-speaking actor GlowComa to function as a remote access trojan, capable of persistent command execution and extensive credential theft on infected Macs.
The ICMacOS malware, previously known as Icarus macOS, has undergone a significant evolution, transforming from a mere information stealer into a sophisticated remote access trojan (RAT). This updated version, promoted by the Russian-speaking threat actor group GlowComa, now offers persistent command execution capabilities on infected Macs, significantly increasing the risk to users and organizations.
GlowComa actively advertises ICMacOS on various Russian-speaking cybercrime forums, including XSS, Exploit.in, and Rehub, with updates and support disseminated via Telegram. The malware is offered as a service, with pricing starting at $699 weekly and escalating to $1,699 monthly. Buyers gain access to a management panel that provides real-time tracking of infected devices, stolen passwords, cookies, files, and cryptocurrency wallets, alongside instant Telegram alerts for new data exfiltrations. This panel, developed in Go and utilizing a MySQL backend, offers a centralized dashboard for managing stolen assets.
The infection vector for ICMacOS typically begins with users being directed to deceptive "ClickFix" pages. These pages trick victims into pasting malicious commands directly into their macOS Terminal application, a tactic also observed in other macOS credential theft campaigns. This social engineering approach effectively turns the user into the unwitting trigger for malware execution. The initial Bash script then retrieves a campaign-specific dropper, which proceeds to alter Terminal preferences to conceal window details. Subsequently, it employs AppleScript to display a convincing fake "System Preferences" password dialog, attempting to capture the user's login credentials.
Following the password capture, the malware checks the architecture of the infected Mac (Intel or Apple Silicon) and downloads the appropriate payload. It then launches the main malware component in the background, using the captured password and campaign details as arguments. To cover its tracks, the script closes the Terminal window and presents a fabricated error message, the content of which is dynamically retrieved from the attacker's server. While the developer claims compatibility from macOS Sierra onwards, the full extent of its compatibility across all macOS versions remains unconfirmed.
The primary payload is a 64-bit Mach-O executable written in Go. The initial version of ICMacOS includes checks for Russian language settings and the device's public IP country, acting as a safeguard to avoid detection or targeting within Russia and Commonwealth of Independent States countries, aligning with the operator's advertised restrictions. Its data collection modules are extensive, targeting browser-saved passwords, cookies, and browsing history, as well as cryptocurrency wallets and data from password managers. Crucially, it also targets developer-specific files, including AWS credentials, Kubernetes configurations, SSH keys, Git credentials, and various environment files, posing a significant risk to software development pipelines and cloud infrastructure.
Beyond developer credentials, ICMacOS also exfiltrates messaging data from popular applications like Telegram, WhatsApp, Discord, and Apple Messages, along with information stored in Apple Notes and Termius. The malware attempts to decrypt Keychain contents using the captured password and an embedded Go library. If this decryption fails, it resorts to using Apple's built-in security utility, often employing additional fake prompts to solicit administrator privileges. All collected data is compressed into a hidden ZIP archive and exfiltrated via HTTPS requests. A supplementary Python payload further expands data collection to include VPN profiles, Slack, Signal, Zoom, and various documents found in common user directories, and it converts browser cookies into a format suitable for session hijacking.
The second, more advanced version of ICMacOS introduces significant enhancements, particularly in establishing persistence and expanding its remote access capabilities. Before setting up persistence, it actively checks for existing malware processes and available privileges. It then installs a LaunchAgent with a name designed to mimic legitimate Apple system processes, ensuring it loads into the active user session. The malware's configuration includes mechanisms to maintain its running state and a fallback interval of 60 minutes, designed to automatically restore access if the process is terminated. This version also establishes a persistent WebSocket connection using the Gorilla WebSocket library, enabling real-time command and control.
Commands received from the attacker's server are executed directly through the Unix shell, with the output streamed back in real time. This functionality mirrors the capabilities of other advanced RATs, such as Atomic Stealer, which also evolved from an information stealer to a persistent remote access threat. Version 2 further broadens its data collection to include clipboard text, Outlook data, Steam files, browser autofill records, and shell history. Security professionals are advised to monitor for unusual password dialogs, suspicious Terminal activity, the presence of hidden temporary archives, and newly created LaunchAgents. Suspected infections should be immediately isolated, with all exposed credentials reset from a known clean system and active sessions thoroughly reviewed.