SOCRadar researchers have just published a new analysis of ICMacOS (also marketed as Icarus macOS), a Malware-as-a-Service infostealer for macOS that has been actively advertised on Russian-speaking cybercrime forums, including XSS, Exploit.in, and Rehub, since early September 2026.
Key findings include:
- Rapid evolution: Within weeks of its public launch, ICMacOS moved from one-shot credential and wallet theft to a persistent remote access trojan, adding LaunchAgent persistence and a live WebSocket-based shell that lets operators run commands on infected Macs in real time
- Developer and enterprise exposure: The malware specifically harvests SSH keys, AWS, Kubernetes and cloud CLI credentials, Git tokens, and .env files, creating a potential pathway from a single compromised Mac into broader enterprise infrastructure and the software supply chain
- Convincing social engineering: ICMacOS is delivered through ClickFix pages that trick victims into pasting terminal commands, then displays a fake “System Preferences” dialog to capture the user’s login password and validates it against the local Keychain
- Wide collection scope: Targets include browser credentials and cookies across Chromium, Safari, and Firefox, 29 browser extensions covering crypto wallets and password managers, desktop crypto wallets, the macOS Keychain, Telegram, WhatsApp, Discord, iMessage, and Apple Notes; the latest version adds Steam, Outlook, clipboard contents, and additional password managers
- Commercial operation: The stealer is sold by an actor using the handle GlowComa, operating under the MADHASH crypto-draining affiliate group, at $699 per week, $1,199 every two weeks, or $1,699 per month, and it is configured to avoid infecting systems in Russia and CIS countries
For full details, the analysis can be found here: https://socradar.io/blog/icmacos-infostealer-rat/
Related
This entry was posted on October 12, 2026 at 2:05 pm and is filed under Commentary with tags SOCRadar. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Inside ICMacOS: From an Infostealer to a Persistent RAT
SOCRadar researchers have just published a new analysis of ICMacOS (also marketed as Icarus macOS), a Malware-as-a-Service infostealer for macOS that has been actively advertised on Russian-speaking cybercrime forums, including XSS, Exploit.in, and Rehub, since early September 2026.
Key findings include:
For full details, the analysis can be found here: https://socradar.io/blog/icmacos-infostealer-rat/
Share this:
Like this:
Related
This entry was posted on October 12, 2026 at 2:05 pm and is filed under Commentary with tags SOCRadar. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.