EN PT-BR
← Voltar ao feed
high technology cryptocurrency

ICMacOS (Icarus) macOS stealer adds WebSocket RAT and LaunchAgent persistence, spread via ClickFix by GlowComa

1 fonte(s) · 1 atualização(ões) · publicado 26/10/2026 09:17 · coletado há 6 dias

SOCRadar identified the ICMacOS (Icarus) macOS stealer in September 2026 and found two variants. Version 2 goes beyond theft: it adds remote-access functionality, WebSocket command-and-control and LaunchAgent persistence that survives reboots. SOCRadar attributes the tool to GlowComa, a financially motivated, Russian-speaking actor active since January 2026, which sells it on XSS, Exploit.in and Rehub under the MADHASH crypto-draining affiliate banner from $699 per week. Moonlock researchers stress the risk to developers, since a single compromised laptop can expose source code and cloud infrastructure.

Detalhes técnicos

  • Delivery: Victims reach ClickFix pages that instruct them to paste commands into Terminal. A Bash dropper shows a fake System Preferences dialog and validates the entered password against the login Keychain, allowing up to five attempts. It then fetches an architecture-specific Go binary for Intel or Apple Silicon.
  • Version 1: core theft of browser credentials, password manager databases, cryptocurrency wallets, developer secrets and messaging data.
  • Version 2: keeps those modules and adds remote command execution over WebSockets. It terminates older instances and checks for root or sudo-capable group membership, then chooses elevated or user-level persistence.
  • Persistence: a property list in the user's Library LaunchAgents path labelled com.apple.systemupdater, which mimics Apple services. With KeepAlive enabled and a 3,600-second start interval it relaunches if stopped and runs hourly.
  • Developer targeting: searches for SSH keys, AWS and Kubernetes configurations, Git and package-manager credentials, and .env files.
  • Ecosystem: bundled with the Icarus ClickFix panel and a crypto clipper. The seller's reputation is mixed, with forum arbitration disputes citing poor payload conversion, fast detection and unfulfilled guarantees. The article also notes Jamf Threat Labs' AMOS campaign abusing Script Editor and MacSync's 2025 Go-based backdoor as part of the same trend. Go-based agents avoid the curl-based process chains of older tooling, so network-layer detection matters.

Remediação

  • Hunt for the com.apple.systemupdater.plist LaunchAgent, hidden logs /tmp/.update-helper.log and /tmp/.cache-update.log, and hidden ZIP archives in /tmp.
  • Investigate any traffic to escapeai[.]live (including its WebSocket endpoint) and mikoblico[.]xyz.
  • Rotate SSH keys and cloud credentials after any suspected exposure, enable MFA on financial accounts and keep cryptocurrency balances on Macs minimal.
  • Treat any instruction to paste commands into Terminal or run a script in Script Editor as hostile unless verified. Apple's tested Terminal warning for ClickFix will not catch every attempt.

Linha do tempo

  1. gbhackers.com ↗ · pub. 26/10/2026 09:17 · coletado 26/10 10:00 primeiro registro

    ICMacOS (Icarus) macOS stealer adds WebSocket RAT and LaunchAgent persistence, spread via ClickFix by GlowComa

    ler a análise desta fonte

    SOCRadar identified the ICMacOS (Icarus) macOS stealer in September 2026 and found two variants. Version 2 goes beyond theft: it adds remote-access functionality, WebSocket command-and-control and LaunchAgent persistence that survives reboots. SOCRadar attributes the tool to GlowComa, a financially motivated, Russian-speaking actor active since January 2026, which sells it on XSS, Exploit.in and Rehub under the MADHASH crypto-draining affiliate banner from $699 per week. Moonlock researchers stress the risk to developers, since a single compromised laptop can expose source code and cloud infrastructure.

    Technical Details

    • Delivery: Victims reach ClickFix pages that instruct them to paste commands into Terminal. A Bash dropper shows a fake System Preferences dialog and validates the entered password against the login Keychain, allowing up to five attempts. It then fetches an architecture-specific Go binary for Intel or Apple Silicon.
    • Version 1: core theft of browser credentials, password manager databases, cryptocurrency wallets, developer secrets and messaging data.
    • Version 2: keeps those modules and adds remote command execution over WebSockets. It terminates older instances and checks for root or sudo-capable group membership, then chooses elevated or user-level persistence.
    • Persistence: a property list in the user's Library LaunchAgents path labelled com.apple.systemupdater, which mimics Apple services. With KeepAlive enabled and a 3,600-second start interval it relaunches if stopped and runs hourly.
    • Developer targeting: searches for SSH keys, AWS and Kubernetes configurations, Git and package-manager credentials, and .env files.
    • Ecosystem: bundled with the Icarus ClickFix panel and a crypto clipper. The seller's reputation is mixed, with forum arbitration disputes citing poor payload conversion, fast detection and unfulfilled guarantees. The article also notes Jamf Threat Labs' AMOS campaign abusing Script Editor and MacSync's 2025 Go-based backdoor as part of the same trend. Go-based agents avoid the curl-based process chains of older tooling, so network-layer detection matters.

    Remediation

    • Hunt for the com.apple.systemupdater.plist LaunchAgent, hidden logs /tmp/.update-helper.log and /tmp/.cache-update.log, and hidden ZIP archives in /tmp.
    • Investigate any traffic to escapeai[.]live (including its WebSocket endpoint) and mikoblico[.]xyz.
    • Rotate SSH keys and cloud credentials after any suspected exposure, enable MFA on financial accounts and keep cryptocurrency balances on Macs minimal.
    • Treat any instruction to paste commands into Terminal or run a script in Script Editor as hostile unless verified. Apple's tested Terminal warning for ClickFix will not catch every attempt.