ICMacOS (Icarus macOS) is a macOS malware-as-a-service stealer marketed since September 2026 by a Russian-speaking actor. It targets macOS Sierra through current versions on both Intel and Apple Silicon architectures. Initially a credential stealer, it evolved into a persistent remote access trojan (RAT) with WebSocket-based command-and-control. Infection uses social engineering with fake system dialogs to harvest administrator passwords and deploy the payload. Version 1 steals browser credentials, cryptocurrency wallets, developer secrets, messaging data, and password managers. Version 2 adds RAT features with persistence and interactive shell access, expanding data theft to Steam accounts, Outlook data, and more password managers.
A detailed technical analysis examines the evolution of MacSync, a macOS stealer-as-a-service initially known as Mac.c, which targets cryptocurrency enthusiasts and developers. The malware has undergone significant changes, replacing AppleScript-based droppers with binary executable files written in Objective-C and Swift. The infection chain utilizes malicious DMG images and employs iCloud infrastructure for payload delivery. MacSync collects extensive data including browser credentials, cryptocurrency wallets, Telegram data, SSH configurations, and keychain files. The stealer incorporates novel techniques like PAM API for password verification and features a backdoor module for persistent access. Distribution occurs through social engineering, fake applications, and cracked software disguised as legitimate crypto wallets like the nonexistent Toria wallet, promoted through dedicated websites and social media channels.
MacSync Stealer is a macOS information stealer and remote-access stager delivered through ClickFix social engineering and malvertising campaigns. Operating under a malware-as-a-service model, it employs sophisticated evasion techniques including process daemonization, single-byte XOR obfuscation, and in-memory AppleScript execution to bypass Apple Gatekeeper, XProtect, and EDR solutions. The malware exfiltrates credentials, browser data, cryptocurrency wallets, and SSH keys through fault-tolerant 10MB chunked uploads to command-and-control infrastructure. MacSync targets professionals in software engineering, cryptocurrency, fintech, and corporate environments across North America, Europe, and Asia-Pacific regions, with campaigns impersonating legitimate services like Google Meet, Claude AI, Docker, and TradingView to trick victims into executing malicious Terminal commands.
MioLab, also known as Nova, is a sophisticated Malware-as-a-Service platform targeting macOS environments, heavily advertised on Russian-speaking underground forums. The platform features extensive data exfiltration capabilities, including browser credential theft, cryptocurrency wallet targeting (supporting over 200 browser extensions and 50+ desktop wallets), and a premium module specifically designed to compromise Ledger and Trezor hardware wallets by intercepting 24-word BIP39 recovery seed phrases. The lightweight C-based payload supports both Intel and Apple Silicon architectures across macOS versions from Sierra to Tahoe. MioLab employs sophisticated social engineering through customizable DMG builders with live preview features, fake system prompts, and ClickFix integration. Recent updates demonstrate rapid development, including Safari cookie grabbing, automated Apple Notes decryption, and universal hardware wallet modules. The operation utilizes bulletproof hosting services and shares infrastruct...
A sophisticated macOS stealer called notnullOSX emerged in March 2026, developed by threat actor alh1mik (formerly 0xFFF) who returned after a 2023 exit from underground forums. This Go-written modular stealer exclusively targets macOS users with cryptocurrency holdings exceeding $10,000. Distribution occurs through ClickFix social engineering and malicious DMG files disguised as legitimate applications like WallSpace. The malware employs a modular architecture with specialized components to exfiltrate iMessage history, Apple Notes, browser credentials, Safari cookies, crypto wallet files, SSH keys, and cloud provider credentials. By social-engineering victims into granting Full Disk Access, notnullOSX bypasses macOS TCC protections without triggering permission dialogs. The stealer maintains persistent WebSocket connections to Firebase infrastructure, functioning as both an infostealer and backdoor with remote module update capabilities.
A sophisticated campaign using typo-squatted 'Spectrum' domains has been uncovered, spreading a new Atomic macOS Stealer (AMOS) variant. The attack, disguised as a CAPTCHA verification, employs dynamic payloads based on the victim's operating system. For macOS users, a malicious shell script steals system passwords and downloads an AMOS variant. The script uses native macOS commands to harvest credentials, bypass security, and execute malicious binaries. Russian-language comments in the source code suggest involvement of Russian-speaking cybercriminals. The campaign's delivery sites show flawed logic, indicating hasty assembly. This multi-platform social engineering attack targets both consumer and corporate users, highlighting an increasing trend in cross-platform threats.
