ICMacOS Propose Change

According to SOCRadar, ICMacOS, also known as Icarus macOS, is a macOS infostealer written in Go and sold under a Malware-as-a-Service subscription model since early September 2026, delivered through ClickFix-style social engineering that persuades the victim to paste shell commands into a terminal. Bash dropper scripts prompt for and validate the victim's login password against the local Keychain, select a build matching the Intel or Apple Silicon architecture, and launch the main Mach-O payload, which aborts if it detects a CIS locale or geolocation. The stealer collects host metadata, credentials, cookies, history and extension data from all major macOS browser engines, desktop cryptocurrency wallets, messaging session tokens, cloud and developer credentials, and decrypts Keychain material offline using an embedded library and the captured password, falling back to scripted dialogs that impersonate system prompts in order to obtain administrator privileges before archiving and exfiltrating the collected data over HTTP. A second version turns it into a persistent remote access trojan, adding launch agent persistence under Apple-like naming, de-confliction against already running instances, privilege assessment, tampering with terminal preferences to hide activity, and an interactive WebSocket command channel, with a complementary Python component gathering further files, VPN configurations and session cookies.

References

There is no Yara-Signature yet.