ICMacOS macOS stealer gains RAT capabilities with reboot persistence
Original title: Hackers Turn Mac Password Stealer Into RAT That Survives Reboots and Executes Remote Commands
ICMacOS now includes WebSocket remote commands and LaunchAgent persistence that survives reboots.
SOCRadar identified the ICMacOS macOS stealer marketed as ICMacOS. Version 2 adds full remote-access functionality using WebSockets for command-and-control and LaunchAgents for persistence. The agent is named com.apple.systemupdater and relaunches after reboots. GlowComa, a financially motivated Russian-speaking actor, markets it on XSS, Exploit.in, and Rehub. Victims are lured via ClickFix pages and fake password dialogs.
Unconfirmed: GlowComa attribution by SOCRadar
- Version 2 adds WebSocket-based remote command execution
- Uses com.apple.systemupdater LaunchAgent with hourly KeepAlive
- Terminates older instances before setting persistence
- Promoted under MADHASH crypto-draining banner for $699 per week
Impact: remote code execution and long-term persistence on macOS
- 1.check for com.apple.systemupdater.plist LaunchAgent
- 2.investigate traffic to escapeai[.]live and mikoblico[.]xyz
- 3.rotate SSH keys and cloud credentials
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | escapeai.live | che-update.log, and hidden ZIP archives in /tmp. Traffic to escapeai[.]live, including its WebSocket endpoint, and to mikoblico[.]xyz |
| domain | mikoblico.xyz | o escapeai[.]live, including its WebSocket endpoint, and to mikoblico[.]xyz warrants immediate investigation. Apple has tested a Term |
From the original article
2 min read at gbhackers.com
The Icarus macOS stealer, marketed as ICMacOS, has moved beyond smash-and-grab theft. Its latest version installs persistence, keeps a live channel open to its operators, and executes commands sent from a remote server. SOCRadar identified ICMacOS in September 2026 and found two variants.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.