Inside ICMacOS: From an Infostealer to a Persistent RAT

Summary

ICMacOS, also known as Icarus macOS, is a newly identified macOS Malware-as-a-Service (MaaS) that has evolved from a credential stealer into a persistent Remote Access Trojan (RAT). It targets high-value information including browser credentials, cryptocurrency wallets, and developer secrets such as SSH keys and cloud configurations. The malware uses ClickFix-based social engineering for delivery and WebSockets for real-time command-and-control.

Investigation

The SOCRadar Threat Research Unit (STRU) identified ICMacOS through telemetry analysis and underground forum monitoring. Researchers traced the infection chain from initial Bash dropper scripts to deployment of Mach-O binaries and Python-based auxiliary payloads. The investigation documented the progression from Version 1, focused on stealing data, to Version 2 with RAT functionality, while mapping C2 infrastructure through WebSocket analysis.

Mitigation

Organizations should enforce strict controls around terminal command execution and monitor for suspicious LaunchAgent modifications. Hardening macOS systems with disk encryption and MDM policies that restrict unauthorized LaunchAgents is recommended. Security teams should also monitor unusual outbound WebSocket connections and unauthorized access to Keychain services as potential indicators of compromise.

Response

When ICMacOS activity is detected, isolate the affected macOS host from the network to stop data exfiltration and further C2 communication. Perform a comprehensive forensic review of the /tmp directory, LaunchAgents, and user Keychain activity. Rotate potentially compromised credentials, including SSH keys, cloud provider tokens such as AWS and Kubernetes credentials, and browser-stored passwords.

Simulation Execution

• Attack Narrative & Commands: An adversary has gained initial access to a macOS workstation and is deploying the ICMacOS stealer. To evade detection by the user and minimize the window for manual observation, the malware executes a script via zsh. The script first uses basename $0 to determine its filename for further obfuscation of its presence in the filesystem. Immediately after initiating its malicious payload (simulated by an enumeration of ICMACOS processes), the script attempts to crash the user’s terminal window using killall Terminal to force the user out of the active session and hide the command history.

• Regression Test Script:

    #!/bin/zsh
    # Simulation script for ICMacOS Stealer detection validation
  
    echo "[+] Starting ICMacOS Stealer Simulation..."
  
    # 1. Trigger selection_basename_killall via 'basename $0'
    echo "[+] Executing obfuscation pattern: basename $0"
    /bin/zsh -c "echo $(basename $0)"
  
    # 2. Trigger selection_basename_killall via 'killall Terminal'
    echo "[+] Executing concealment pattern: killall Terminal"
    # Note: We use a subshell to ensure the simulation script itself doesn't die instantly 
    # if run in a real terminal, but for the purpose of the rule, we want the command to fire.
    /bin/zsh -c "killall Terminal" 2>/dev/null || echo "[!] killall failed (Terminal not running or permission denied)"
  
    # 3. Trigger selection_pgrep via 'pgrep ICMACOS'
    echo "[+] Executing enumeration pattern: pgrep ICMACOS"
    /bin/zsh -c "pgrep ICMACOS"
  
    echo "[+] Simulation commands dispatched."

• Cleanup Commands:

    # No persistent files were created by the simulation script. 
    # If any temp files were used, they should be removed here.
    rm -f /tmp/icmacos_sim_test