New macOS Malware Uses Fake System Prompts to Steal Passwords and Deploy RAT

A newly marketed macOS malware-as-a-service platform, ICMacOS, is using fake Apple system dialogs to steal login passwords before deploying an information stealer that has evolved into a persistent remote-access trojan (RAT).

The operator markets the toolkit across cybercrime forums and Telegram as part of a broader “ICARUS” criminal suite that also includes a ClickFix delivery panel and a cryptocurrency clipper.

The campaign highlights the continuing commercialisation of macOS-focused malware.

macOS accounted for 32.9% of professional developers’ primary work operating systems in Stack Overflow’s 2025 survey, making developer endpoints a particularly attractive route to cloud accounts, SSH keys, source-code repositories, package registries and cryptocurrency wallets.

ICMacOS is delivered through ClickFix social-engineering pages that persuade a target to copy and run a command in Terminal.

The initial Bash-based dropper then downloads a second-stage component, hides visible Terminal indicators, and displays a spoofed “System Preferences” password prompt.

The supplied password is validated against the victim’s local login Keychain before the final payload is retrieved and launched.

The malware distinguishes between Apple Silicon and Intel Macs using the uname -m command, enabling operators to deliver ARM64 or AMD64 payloads.

This cross-architecture support makes the service viable against a broad macOS estate, from legacy Intel devices to current Apple Silicon endpoints.

The primary ICMacOS payload is a 64-bit Mach-O binary written in Go. Version 1 primarily functions as an infostealer, harvesting browser credentials, cookies, browsing history, password-manager data, cryptocurrency-wallet files, Telegram sessions, Discord tokens, WhatsApp databases, iMessage data, and Apple Notes.

It also searches for developer credentials, including AWS profiles, Kubernetes configurations, Docker authentication files, GitHub CLI tokens, SSH private keys, .env files and shell-history records.

Researchers at SOCRadar’s Threat Research Unit said ICMacOS, also called Icarus macOS, has been advertised since early September 2026 by a Russian-speaking threat actor known as GlowComa.

macOS Credential Stealing

The Keychain theft capability is especially significant. ICMacOS reportedly incorporates keychainbreaker, an open-source Go library that can parse and decrypt macOS login.keychain-db files when the attacker has the user’s login password.

The project’s documentation confirms that it supports extraction of generic passwords, internet passwords, private keys and certificates from compatible Keychain databases.

Where offline Keychain parsing fails, the malware falls back to macOS’s native security utility and attempts to trick victims into approving an administrator-level operation through another fake system prompt.

This two-stage approach gives attackers both the user’s password and a potential route to broader credential extraction.

Version 2 substantially increases the threat by converting the stealer into a RAT. It creates a LaunchAgent named com.apple.systemupdater.plist, a masquerading label designed to resemble a legitimate Apple component.

The persistence mechanism uses KeepAlive and a scheduled interval to relaunch the malware after process termination and across user logins.

The newer variant also establishes a WebSocket-based command-and-control channel, enabling operators to issue shell commands remotely and receive command output in real time.

In effect, a successful infection can shift from one-time data theft to ongoing interactive control of a Mac.

SOCRadar said ICMacOS is marketed under a subscription model, while GlowComa advertises the service alongside its ClickFix panel to affiliates.

Such packaging lowers the barrier for financially motivated criminals to run macOS credential-theft campaigns at scale.

ICMacOS reflects a wider change in the macOS threat landscape: stealers are increasingly becoming persistent access tools rather than single-use collection malware.

Moonlock reported that ClickFix remains a dominant macOS access technique, exploiting the fact that victims execute the malicious command themselves and can therefore bypass many file-centric protections.

For defenders, high-priority indicators include unexpected Terminal or osascript activity, fake macOS authentication prompts, new user LaunchAgents, suspicious processes executing from /tmp, and outbound connections to unrecognised domains or WebSocket endpoints.

Security teams should also monitor access to Keychain files, browser profile databases, cloud credential directories and developer-secret locations.

Mac users should never paste commands into Terminal or Script Editor because a website, CAPTCHA, document, recruiter or video-call page instructs them to do so.

Organisations should restrict local administrator privileges, deploy macOS endpoint detection, audit LaunchAgents, rotate exposed developer and cloud credentials, and investigate any endpoint that may have submitted a password to an untrusted dialog.

IOCs

Indicator	Description
Domain	escapeai[.]live	ICMacOS Login
Domain	mikoblico[.]xyz	ICMacOS Login
IP Address	85.137.253[.]61	ICMacOS Login
IP Address	45.13.186[.]247	ICMacOS Login
URL	hxxps[://]escapeai[.]live/api/build_config	ICMacOS Build Downloader URL
URL	hxxps[://]escapeai[.]live/icmacos_run_v2[.]command?t={date}	ICMacOS Downloader URL

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.