ICMacOS Evolves From Credential Stealer Into Persistent Remote Access Trojan

A macOS malware service called ICMacOS has rapidly evolved from a one-shot information stealer into a persistent remote access trojan, according to new SOCRadar research.

The latest version adds LaunchAgent persistence and a WebSocket-based shell that lets operators execute commands on infected Macs in real time. It is distributed through ClickFix pages that persuade victims to paste commands into Terminal, then uses a fake System Preferences dialog to capture and validate the user's password against the local Keychain.

Its collection scope extends beyond browser cookies and cryptocurrency wallets. SOCRadar says the malware targets SSH keys, AWS and Kubernetes credentials, cloud command-line profiles, Git tokens and environment files. A compromised developer workstation could therefore become a path into production infrastructure or software repositories.

The malware is sold on Russian-speaking criminal forums by an actor using the handle GlowComa, with subscriptions starting at $699 per week. Enterprises should restrict unsigned scripts, monitor LaunchAgent changes, protect developer secrets with short-lived credentials and train users to treat copy-and-paste Terminal instructions as executable code.