Icarus stealer claims to have numerous functionalities that include 2FA bypass, rootkit hVNC, encrypted connection, XOR/AES payload encryption, a fake login page, shell code payload, export the payload as macro, RunPE (process hollowing technique), Telegram stealers, Discord stealers, password recovery and more.

What makes Icarus Stealer different from other stealers such as Raccoon Stealer and Redline Stealer is that it uses an hVNC capability, which lets an attacker create a new hidden desktop to navigate through the computer system without interacting with the main desktop.