ICMacOS Infostealer Adds Persistent Remote Access and Targets Developer Credentials

ICMacOS, also known as Icarus macOS, has evolved from a macOS information stealer into a persistent remote access trojan. SOCRadar identified the malware-as-a-service offering in September 2026, promoted by the financially motivated, Russian-speaking actor GlowComa. It uses ClickFix social engineering and spoofed macOS password dialogs to obtain victims’ login passwords and deploy architecture-specific payloads. Its collection targets include browser credentials and sessions, cryptocurrency wallets, Keychain contents, messaging sessions, and developer secrets; the malware excludes Russia and CIS countries.

The second analyzed version adds LaunchAgent persistence and a persistent WebSocket command channel that executes interactive shell commands and returns output in real time. A supplementary Python payload expands theft to VPN configurations, additional messaging applications, and sensitive documents. Stolen cloud credentials, SSH keys, and Kubernetes configurations could enable access to enterprise infrastructure beyond the infected Mac. Defenders should use the network and host indicators documented in SOCRadar’s report to investigate suspected infections, isolate affected devices, reset exposed credentials from a clean system, and review active sessions.