Inside ICMacOS: From an Infostealer to a Persistent RAT

ICMacOS (Icarus macOS) is a macOS malware-as-a-service stealer marketed since September 2026 by a Russian-speaking actor. It targets macOS Sierra through current versions on both Intel and Apple Silicon architectures. Initially a credential stealer, it evolved into a persistent remote access trojan (RAT) with WebSocket-based command-and-control. Infection uses social engineering with fake system dialogs to harvest administrator passwords and deploy the payload. Version 1 steals browser credentials, cryptocurrency wallets, developer secrets, messaging data, and password managers. Version 2 adds RAT features with persistence and interactive shell access, expanding data theft to Steam accounts, Outlook data, and more password managers.

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMalware2026-09-29
• A new version of the MacSync macOS stealer targets crypto enthusiasts and developersMalware2026-09-24
• MacSync: The Evasive macOS Stealer Exploiting ClickFix LuresMalware2026-09-08
• From open lures to cloaked gates: How a macOS ClickFix campaign learned to hideMalware2026-08-05
• A new Mac stealer targeting $10K+ crypto walletsMalware2026-04-15