Researchers report a real-world macOS malware operation (ICMacOS) being sold as a service and delivered through “ClickFix” social-engineering pages. Victims are pushed to copy/paste Terminal commands and then shown fake macOS system dialogs that trick them into entering their login password, enabling credential theft and (in newer versions) persistent remote access.
ICMacOS is a macOS malware-as-a-service stealer promoted by an actor known as GlowComa. It reaches victims through ClickFix social-engineering pages that present themselves as a software fix or installer and instruct the visitor to copy and paste a Terminal command. That command runs a Bash script which retrieves the primary dropper payload from an attacker-controlled domain, saves it to /tmp, and executes it directly on the victim's machine.
Once running, the dropper uses osascript to generate a spoofed macOS System Preferences dialog asking for the victim's login password. To confirm the password is correct, the malware checks it against the local login Keychain and allows up to five attempts before giving up. The script then hides the Terminal window to reduce the chance the victim notices anything unusual.
The scheme works because it borrows two things people are conditioned to trust: the Terminal, which developers and technical users treat as a normal part of installing or fixing software, and the native macOS System Preferences dialog, which looks like a routine system request rather than something controlled by a malicious script. By chaining a believable "fix" pretext with a convincing system prompt, the attacker gets the victim to self-inflict the compromise by running the command and entering their own credentials.
Organizations supporting macOS users, especially developers and IT staff, should reinforce a few habits. Never run Terminal commands copied from a website unless they come through an approved internal process that has been independently verified. Treat any unexpected macOS password prompt as suspicious, particularly one that appears mid-install, and confirm with IT through a known contact method rather than entering credentials on the spot. Security teams should also watch for unusual script downloads and executions from temporary folders like /tmp, especially when paired with attempts to hide Terminal activity, since these behaviors align with how ICMacOS and similar ClickFix-based droppers operate before escalating to credential theft or remote access.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ICMacOS is a macOS malware-as-a-service stealer promoted by an actor known as GlowComa. It is delivered through ClickFix social-engineering pages that provide malicious copy/paste Terminal commands.
After the initial script runs, the dropper uses osascript to spawn a spoofed macOS System Preferences dialog that asks for the login password, then validates the captured password against the local Keychain.
It targets browser and password-manager data, cryptocurrency wallets, developer secrets like AWS, Kubernetes, SSH and .env files, and messaging tokens including Telegram session tokens.
A newer version of the malware adds full RAT capability with persistence, notably via LaunchAgents, and uses WebSockets for command-and-control.
If a website tells you, “Open Terminal and paste this command to fix it,” you’re in ICMacOS territory. GlowComa’s ICMacOS scam uses these ClickFix pages to make you paste a command that secretly downloads from escapeai.live into /tmp, runs it, then pops up a fake macOS System Preferences password box. Type your password there and ICMacOS validates it against your Keychain, then starts looting: browser passwords, password managers, crypto wallets, AWS and Kubernetes keys, SSH keys, even Telegram session tokens, plus a RAT that can stick around via LaunchAgents. Aha moment: legit fixes almost never need you to paste random Terminal commands from a website. If any site tells you to do that, stop and contact IT using our normal help channel before you touch Terminal.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
A macOS info-stealing malware called ClickLock Stealer uses a fake “Cloudflare verification” page to trick users into copying and running a Terminal command. It then steals browser, crypto wallet, and Keychain data and sends it to attackers via a Telegram bot, while killing processes to hide…
Researchers found a real macOS malware campaign that uses a fake GitHub download page to convince users to paste a command into Terminal and enter their Mac password. The malware then steals credentials, cookies, and files, and can even turn the victim’s Chromium browser into a remotely controlled…
Researchers documented a real macOS data-stealing campaign that relies on social engineering instead of software bugs. Victims are sent to a fake “verification” page that tells them to copy and paste a command into Terminal, which silently installs a stealer and then pressures them to enter their…
Researchers found a new macOS infostealer, “ClickLock Stealer,” that uses ClickFix-style fake verification pages to trick people into running Terminal commands. After infection, it shows a realistic macOS password prompt and can effectively lock the Mac until the victim enters the correct password,…
A real-world social engineering attempt used a legitimate Google Doc to trick a target into manually running commands that installed malware. The attacker posed as a crypto marketing executive and used a fake “decryption failure” message and a “manual update” button as the lure, leading to an…
