ICarus macOS o'g'irlovchisi, ICMacOS nomi bilan sotiladigan, endi tezkor o'g'irlikdan ancha yuqoriga o'tdi. Uning so'nggi versiyasi doimiylikni o'rnatadi, operatorlari bilan jonli kanalni ochiq saqlaydi va masofaviy serverdan yuborilgan buyruqlarni bajaradi.
SOCRadar ICMacOSni 2026-yil sentyabrda aniqladi va ikkita variantni topdi. 1-versiya asosiy o'g'irlikka qaratilgan bo'lib, brauzer ma'lumotlari, parol menejeri ma'lumotlar bazalari, kriptovalyuta hamyonlari, dasturchi sirlari va xabar almashish ma'lumotlarini nishonga oladi.
2-versiya ushbu modullarni saqlab qoladi va to'liq masofaviy kirish funksiyasini qo'shadi, buyruq va nazorat uchun WebSockets va doimiylik uchun LaunchAgents dan foydalanadi.
Doimiylik mexanizmi yashirin ishlashga mo'ljallangan. Zararli dastur foydalanuvchining Library jildidagi LaunchAgent yo'liga com.apple.systemupdater nomli xususiyatlar ro'yxatini yozadi.
Bu nom Apple'ning o'z xizmatlarini taqlid qiladi. KeepAlive yoqilgan va 3600 soniyalik ishga tushirish oralig'i bilan agent to'xtasa qayta ishga tushadi va har soatda yana ishlaydi, bu esa qayta yuklanishdan omon qolishiga imkon beradi.
Doimiylikni o'rnatishdan oldin, 2-versiya eski nusxalarni to'xtatadi va root yoki sudo-ga qodir guruh a'zoligiga ega ekanligini tekshiradi, so'ngra mos ravishda yuqori yoki foydalanuvchi darajasidagi doimiylikni tanlaydi.
ICMacOS boshqaruv paneli, bu RAT/o'g'irlovchini boshqaradigan kiberjinoyatchilar tomonidan ishlatiladi (Manba: Moonlock).
Jabrlanuvchilar odatda ClickFix sahifalariga yetib boradi, ular terminal buyruqlarini bajarishni ko'rsatadi. Bash tushiruvchi so'ngra soxta System Preferences dialogini ko'rsatadi va kiritilgan parolni login Keychain bilan tekshiradi, beshtagacha urinishga ruxsat beradi.
So'ngra u Intel yoki Apple Silicon Mac'lari uchun arxitekturaga mos Go binar faylini oladi. Hujumchilar foydalanuvchi harakatlarini ham kamaytirmoqda.
Jamf Threat Labs yaqinda Script Editor yordamida bitta Execute tugmasidan zararli skriptni ishga tushirgan AMOS kampaniyasini hujjatlashtirdi.
SOCRadar ICMacOSni GlowComa'ga bog'laydi, bu 2026-yil yanvardan beri faol bo'lgan, moliyaviy maqsadli, rus tilida gapiradigan aktyor.
Asbob XSS, Exploit.in va Rehub'da MADHASH kripto-oqim affiliate banneri ostida targ'ib qilinadi, narxlar haftasiga 699 dollardan boshlanadi.
ICMacOS sizdan soxta tizim parol so'rovi bilan parolingizni so'raydi (Manba: Moonlock).
U Icarus ClickFix paneli va kripto klipper bilan birga taqdim etiladi. Sotuvchining obro'si aralash. Forum arbitraj nizolari yomon payload konversiyasi, tez aniqlanish va bajarilmagan kafolatlarni keltiradi.
Moonlock tadqiqotchilari aytishicha, RAT qobiliyati dasturchilar uchun eng muhim. ICMacOS SSH kalitlari, AWS va Kubernetes konfiguratsiyalari, Git va paket menejeri ma'lumotlari va .env fayllarini qidiradi.
Bitta buzilgan noutbuk manba kod va bulut infratuzilmasiga yo'l ochishi mumkin. Doimiylik operatorlarga birinchi o'g'irlikdan ancha keyin ham sessiya tokenlari va hamyonlarni yig'ishda davom etishiga imkon beradi.
Bu kengroq tendensiyani davom ettiradi. MacSync 2025-yilda masofaviy buyruqlarni qabul qiladigan va o'g'irlangan ma'lumotlardan imtiyozli harakatlar uchun qayta foydalanadigan Go asosidagi orqa eshikni qo'shgan edi.
Himoyachilar com.apple.systemupdater.plist LaunchAgent'ini, /tmp/.update-helper.log va /tmp/.cache-update.log kabi yashirin jurnallarni va /tmp'dagi yashirin ZIP arxivlarini tekshirishlari kerak.
escapeai[.]live'ga, shu jumladan uning WebSocket nuqtasiga, va mikoblico[.]xyz'ga trafik darhol tekshirilishi kerak.
Apple ClickFix uchun Terminal ogohlantirishini sinovdan o'tkazgan, lekin u har bir urinishni ushlamaydi. Mac'larda kriptovalyuta balanslarini minimal saqlang, moliyaviy hisoblarda ko'p omilli autentifikatsiyani yoqing va har qanday shubhali ta'sirdan so'ng SSH kalitlari va bulut ma'lumotlarini aylantiring.
Terminalga buyruqlarni joylash yoki Script Editor'da skriptni ishga tushirish bo'yicha har qanday ko'rsatmani, tasdiqlanmagan bo'lsa, dushman deb hisoblang.
Go asosidagi agentlar eski vositalar tayanadigan curl asosidagi jarayon zanjirlaridan qochadi, shuning uchun tarmoq qatlamidagi aniqlash muhim.
The Icarus macOS stealer, marketed as ICMacOS, has moved beyond smash-and-grab theft. Its latest version installs persistence, keeps a live channel open to its operators, and executes commands sent from a remote server.
SOCRadar identified ICMacOS in September 2026 and found two variants. Version 1 focuses on core theft, targeting browser credentials, password manager databases, cryptocurrency wallets, developer secrets, and messaging data.
Version 2 keeps those modules and adds full remote-access functionality, using WebSockets for command-and-control and LaunchAgents for persistence.
The persistence mechanism is designed to blend in. The malware writes a property list to a LaunchAgent path under the user’s Library folder, named com.apple.systemupdater.
This label mimics Apple’s own services. With KeepAlive enabled and a 3,600-second start interval, the agent relaunches if it stops and runs again every hour, which allows it to survive reboots.
Before establishing persistence, Version 2 terminates older instances and checks whether it has root or sudo-capable group membership, then chooses elevated or user-level persistence accordingly.
ICMacOS dashboard, used by cybercriminals operating this RAT/stealer (Source : Moonlock).
Victims typically reach ClickFix pages that instruct them to run terminal commands. A Bash dropper then displays a fake System Preferences dialog and validates the entered password against the login Keychain, allowing up to five attempts.
It then retrieves an architecture-specific Go binary for Intel or Apple Silicon Macs. Attackers are also reducing user actions.
Jamf Threat Labs recently documented an AMOS campaign that used Script Editor to launch a malicious script from a single Execute button.
SOCRadar attributes ICMacOS to GlowComa, a financially motivated, Russian-speaking actor active since January 2026.
The tool is promoted on XSS, Exploit.in, and Rehub under the MADHASH crypto-draining affiliate banner, with pricing starting at $699 per week.
ICMacOS prompts you for your password with a fake system password request (Source : Moonlock).
It is bundled with the Icarus ClickFix panel and a crypto clipper. The seller’s reputation is mixed. Forum arbitration disputes cite poor payload conversion, fast detection, and unfulfilled guarantees.
Moonlock Researchers said that, the RAT capability matters most for developers. ICMacOS searches for SSH keys, AWS and Kubernetes configurations, Git and package-manager credentials, and .env files.
A single compromised laptop can open a path into source code and cloud infrastructure. Persistence lets operators keep harvesting session tokens and wallets long after the first theft.
This follows a broader trend. MacSync added a Go-based backdoor in 2025 that accepted remote commands and reused harvested credentials for privileged actions.
Defenders should check for the com.apple.systemupdater.plist LaunchAgent, hidden logs such as /tmp/.update-helper.log and /tmp/.cache-update.log, and hidden ZIP archives in /tmp.
Traffic to escapeai[.]live, including its WebSocket endpoint, and to mikoblico[.]xyz warrants immediate investigation.
Apple has tested a Terminal warning for ClickFix, but it will not catch every attempt. Keep cryptocurrency balances minimal on Macs, enable multi-factor authentication on financial accounts, and rotate SSH keys and cloud credentials after any suspected exposure.
Treat any instruction to paste commands into Terminal or run a script in Script Editor as hostile unless verified.
Go-based agents avoid the curl-based process chains older tooling relied on, network-layer detection is essential.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.