Hackers Turn Mac Password Stealer Into RAT That Survives Reboots and Executes Remote Commands

The Icarus macOS stealer, marketed as ICMacOS, has moved beyond smash-and-grab theft. Its latest version installs persistence, keeps a live channel open to its operators, and executes commands sent from a remote server.

SOCRadar identified ICMacOS in September 2026 and found two variants. Version 1 focuses on core theft, targeting browser credentials, password manager databases, cryptocurrency wallets, developer secrets, and messaging data.

Version 2 keeps those modules and adds full remote-access functionality, using WebSockets for command-and-control and LaunchAgents for persistence.

The persistence mechanism is designed to blend in. The malware writes a property list to a LaunchAgent path under the user’s Library folder, named com.apple.systemupdater.

This label mimics Apple’s own services. With KeepAlive enabled and a 3,600-second start interval, the agent relaunches if it stops and runs again every hour, which allows it to survive reboots.

Before establishing persistence, Version 2 terminates older instances and checks whether it has root or sudo-capable group membership, then chooses elevated or user-level persistence accordingly.

Victims typically reach ClickFix pages that instruct them to run terminal commands. A Bash dropper then displays a fake System Preferences dialog and validates the entered password against the login Keychain, allowing up to five attempts.

It then retrieves an architecture-specific Go binary for Intel or Apple Silicon Macs. Attackers are also reducing user actions.

Mac Password Stealer

Jamf Threat Labs recently documented an AMOS campaign that used Script Editor to launch a malicious script from a single Execute button.

SOCRadar attributes ICMacOS to GlowComa, a financially motivated, Russian-speaking actor active since January 2026.

The tool is promoted on XSS, Exploit.in, and Rehub under the MADHASH crypto-draining affiliate banner, with pricing starting at $699 per week.

It is bundled with the Icarus ClickFix panel and a crypto clipper. The seller’s reputation is mixed. Forum arbitration disputes cite poor payload conversion, fast detection, and unfulfilled guarantees.

Moonlock Researchers said that, the RAT capability matters most for developers. ICMacOS searches for SSH keys, AWS and Kubernetes configurations, Git and package-manager credentials, and .env files.

A single compromised laptop can open a path into source code and cloud infrastructure. Persistence lets operators keep harvesting session tokens and wallets long after the first theft.

This follows a broader trend. MacSync added a Go-based backdoor in 2025 that accepted remote commands and reused harvested credentials for privileged actions.

Defenders should check for the com.apple.systemupdater.plist LaunchAgent, hidden logs such as /tmp/.update-helper.log and /tmp/.cache-update.log, and hidden ZIP archives in /tmp.

Traffic to escapeai[.]live, including its WebSocket endpoint, and to mikoblico[.]xyz warrants immediate investigation.

Apple has tested a Terminal warning for ClickFix, but it will not catch every attempt. Keep cryptocurrency balances minimal on Macs, enable multi-factor authentication on financial accounts, and rotate SSH keys and cloud credentials after any suspected exposure.

Treat any instruction to paste commands into Terminal or run a script in Script Editor as hostile unless verified.

Go-based agents avoid the curl-based process chains older tooling relied on, network-layer detection is essential.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.