# ICMacOS (Icarus macOS): ClickFix-delivered macOS infostealer evolving into persistent WebSocket RAT (GlowComa / MADHASH)

> ICMacOS is a Go-compiled macOS malware-as-a-service stealer delivered through ClickFix copy-paste Terminal lures. Version 1 steals login passwords, Keychain, browser, developer-secret, messaging and crypto-wallet data; Version 2 adds a Gorilla WebSocket C2 with an interactive shell and LaunchAgent persistence. SOCRadar attributes it to the Russian-speaking operator GlowComa, affiliated with the MADHASH crypto-draining group.

- **Published:** 2026-10-13T07:48:44Z
- **Last reviewed:** 2026-10-13T07:48:44Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3385
- **ID:** TL-2026-3385
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** GlowComa
- **Detections:** 9 · **IOCs:** 37 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ICMacOS (also called Icarus macOS) is a 64-bit Go-compiled Mach-O executable that supports macOS Sierra (10.12) onward on both x86_64 and ARM64. SOCRadar reports that it is sold as a malware-as-a-service subscription by the Russian-speaking actor GlowComa, with marketing starting in early September 2026, and that it evolved from a credential harvester (Version 1) into a persistent RAT (Version 2) within weeks.

Delivery is via ClickFix: a social-engineering page instructs the victim to copy a command and paste it into Terminal. The command fetches a dropper shell script (escapeai.live/icmacos_run_v2.command, or loader_v2.sh with build and owner parameters used for campaign tracking). The dropper logs to /tmp/.update-helper.log, modifies com.apple.Terminal preferences to strip window titles, and uses osascript to show a fake 'System Preferences' dialog that harvests the user's password. It validates the password with 'security unlock-keychain -p' against login.keychain-db, allows up to five attempts, detects architecture with uname -m, fetches a build configuration from https://escapeai.live/api/build_config, downloads the arm64 or amd64 payload (https://escapeai.live/ICMacOs?arch=...), stages it under /tmp/.update-tmp/ICMacOs.gz, launches it via osascript and nohup with the stolen credentials as parameters, and finally runs killall Terminal and shows a fake error dialog. Because the victim runs the command manually, Gatekeeper checks are not triggered.

Version 1 (stealer) starts at main.main(), logs to /tmp/.cache-update.log, and applies a geo-fence using the system locale and an ipinfo.io query that excludes Russia/CIS countries. It steals Chromium-family browser data (Chrome, Brave, Edge, Arc, Yandex, Opera, Vivaldi, Canary) by retrieving each browser's Safe Storage key through 'security find-generic-password', then copying and decrypting Login Data and Cookies. It also collects Safari data (Cookies.binarycookies, History.db and others) and Firefox/Waterfox/Postbox profile files (key4.db, logins.json, cookies.sqlite, cert9.db). It targets 29 browser-extension IDs (crypto wallets including MetaMask, Phantom, Coinbase, Trust, Rabby, Keplr and Ronin, plus the 1Password, Bitwarden, LastPass and Dashlane password managers) and about 20 desktop wallets (Electrum, Exodus, Ledger Live, Sparrow, Atomic, Monero and others). Keychain extraction uses the embedded keychainbreaker Go library with the phished password, falling back to 'security dump-keychain -d' elevated through osascript 'with administrator privileges'. It also collects Telegram tdata, WhatsApp, Discord and Apple Messages data, Apple Notes, Termius, SSH keys, cloud and developer credentials (.aws, gcloud, azure, .kube, Terraform, .git-credentials, .npmrc, .pypirc, .netrc, .pgpass, Docker/podman auth, .gradle), shell histories, and a recursive $HOME search for .env* files. Data is zipped to the hidden file /tmp/.systemd-private-helper.zip and uploaded by HTTPS multipart POST to https://escapeai.live/upload, with a Telegram alert carrying data counts.

Version 2 (RAT) adds anti-duplication ('pgrep ICMACOS' followed by SIGKILL of existing instances), a root/wheel privilege check, and persistence through ~/Library/LaunchAgents/com.apple.systemupdater.plist (label com.apple.systemupdater, loaded with 'launchctl bootstrap gui/<uid>', KeepAlive=true, StartInterval=3600). It adds a real-time interactive C2 over wss://escapeai.live/ws?mac_id={hostname}&username={username} using github.com/gorilla/websocket v1.5.3, with commands piped to /bin/sh and stdout/stderr streamed back. Version 2 also steals Steam session data (loginusers.vdf, config.vdf, .ssfn), Outlook mail stores, clipboard contents (pbpaste), browser autofill and credit-card tables, additional password managers (Keeper, Enpass, NordPass, RoboForm, Trezor Suite) and more terminal histories. A supplementary Python payload (https://escapeai.live/payload.py) adds VPN configs (ProtonVPN, Mullvad, NordVPN, ExpressVPN, WireGuard), Slack/Signal/Zoom session databases, a Desktop/Documents/Downloads file grabber (.txt, .pdf, .docx, .xlsx, .json, .csv, .key) and Netscape-format cookie conversion for session hijacking.

SOCRadar describes GlowComa as financially motivated, active since January 2026, present on the XSS, Exploit.in and Rehub forums (with multiple Exploit.in arbitration disputes over poor conversion rates and fast detection), and contactable via the TOX aliases @ObjectCollision, @SaykatChain and @layer7king. The service bundles the ICARUS ClickFix panel with a multi-chain crypto clipper and is affiliated with the MADHASH crypto-draining group; developer updates are posted on the Telegram channel t.me/s/icmacos. Subscriptions are priced at $699 weekly, $1,199 biweekly and $1,699 monthly (discounted to $899 for ICARUS ClickFix users) and include a Go/MySQL web panel, build analytics, custom VPS integration and Telegram alerts. No CVE or vendor-assigned severity applies; the HIGH severity is the analyst's judgment. No BeaconBeagle matches were found: the IP lookups returned 404 and the escapeai.live config search returned zero results. Note: the Huntress-reported Go-based macOS ClickFix stealer covered by BleepingComputer (2026-08-06, Aeza AS210644 infrastructure) is a separate, unattributed campaign and is cited only as context, not as ICMacOS.

## MITRE ATT&CK

- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1059.006 Python
- T1543.001 Launch Agent
- T1036.005 Match Legitimate Resource Name or Location
- T1480 Execution Guardrails
- T1564 Hide Artifacts
- T1548 Abuse Elevation Control Mechanism
- T1056.002 GUI Input Capture
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1555.005 Password Managers
- T1552.001 Credentials In Files
- T1552.003 Shell History
- T1082 System Information Discovery
- T1057 Process Discovery
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1567 Exfiltration Over Web Service

## Sources

- [Inside ICMacOS: From an Infostealer to a Persistent RAT (SOCRadar)](https://socradar.io/blog/icmacos-infostealer-rat/)
- [ClickFix attack pushes macOS infostealer for crypto theft attacks (BleepingComputer) - related separate Go-based campaign, context only](https://www.bleepingcomputer.com/news/security/clickfix-attack-pushes-macos-infostealer-for-crypto-theft-attacks/)
- [MITRE ATT&CK T1204.004 User Execution: Malicious Copy and Paste](https://attack.mitre.org/techniques/T1204/004/)
- [MITRE ATT&CK T1543.001 Create or Modify System Process: Launch Agent](https://attack.mitre.org/techniques/T1543/001/)
- [MITRE ATT&CK T1555.001 Credentials from Password Stores: Keychain](https://attack.mitre.org/techniques/T1555/001/)
- [MITRE ATT&CK T1056.002 Input Capture: GUI Input Capture](https://attack.mitre.org/techniques/T1056/002/)
- [MITRE ATT&CK T1480 Execution Guardrails](https://attack.mitre.org/techniques/T1480/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3385