ICMacOS (also called Icarus macOS) is a 64-bit Go-compiled Mach-O executable that supports macOS Sierra (10.12) onward on both x86_64 and ARM64. SOCRadar reports that it is sold as a malware-as-a-service subscription by the Russian-speaking actor GlowComa, with marketing starting in early September 2026, and that it evolved from a credential harvester (Version 1) into a persistent RAT (Version 2) within weeks.

Delivery is via ClickFix: a social-engineering page instructs the victim to copy a command and paste it into Terminal. The command fetches a dropper shell script (escapeai.live/icmacos_run_v2.command, or loader_v2.sh with build and owner parameters used for campaign tracking). The dropper logs to /tmp/.update-helper.log, modifies com.apple.Terminal preferences to strip window titles, and uses osascript to show a fake 'System Preferences' dialog that harvests the user's password. It validates the password with 'security unlock-keychain -p' against login.keychain-db, allows up to five attempts, detects architecture with uname -m, fetches a build configuration from https://escapeai.live/api/build_config, downloads the arm64 or amd64 payload (https://escapeai.live/ICMacOs?arch=...), stages it under /tmp/.update-tmp/ICMacOs.gz, launches it via osascript and nohup with the stolen credentials as parameters, and finally runs killall Terminal and shows a fake error dialog. Because the victim runs the command manually, Gatekeeper checks are not triggered.

Version 1 (stealer) starts at main.main(), logs to /tmp/.cache-update.log, and applies a geo-fence using the system locale and an ipinfo.io query that excludes Russia/CIS countries. It steals Chromium-family browser data (Chrome, Brave, Edge, Arc, Yandex, Opera, Vivaldi, Canary) by retrieving each browser's Safe Storage key through 'security find-generic-password', then copying and decrypting Login Data and Cookies. It also collects Safari data (Cookies.binarycookies, History.db and others) and Firefox/Waterfox/Postbox profile files (key4.db, logins.json, cookies.sqlite, cert9.db). It targets 29 browser-extension IDs (crypto wallets including MetaMask, Phantom, Coinbase, Trust, Rabby, Keplr and Ronin, plus the 1Password, Bitwarden, LastPass and Dashlane password managers) and about 20 desktop wallets (Electrum, Exodus, Ledger Live, Sparrow, Atomic, Monero and others). Keychain extraction uses the embedded keychainbreaker Go library with the phished password, falling back to 'security dump-keychain -d' elevated through osascript 'with administrator privileges'. It also collects Telegram tdata, WhatsApp, Discord and Apple Messages data, Apple Notes, Termius, SSH keys, cloud and developer credentials (.aws, gcloud, azure, .kube, Terraform, .git-credentials, .npmrc, .pypirc, .netrc, .pgpass, Docker/podman auth, .gradle), shell histories, and a recursive $HOME search for .env* files. Data is zipped to the hidden file /tmp/.systemd-private-helper.zip and uploaded by HTTPS multipart POST to https://escapeai.live/upload, with a Telegram alert carrying data counts.

Version 2 (RAT) adds anti-duplication ('pgrep ICMACOS' followed by SIGKILL of existing instances), a root/wheel privilege check, and persistence through ~/Library/LaunchAgents/com.apple.systemupdater.plist (label com.apple.systemupdater, loaded with 'launchctl bootstrap gui/<uid>', KeepAlive=true, StartInterval=3600). It adds a real-time interactive C2 over wss://escapeai.live/ws?mac_id={hostname}&username={username} using github.com/gorilla/websocket v1.5.3, with commands piped to /bin/sh and stdout/stderr streamed back. Version 2 also steals Steam session data (loginusers.vdf, config.vdf, .ssfn), Outlook mail stores, clipboard contents (pbpaste), browser autofill and credit-card tables, additional password managers (Keeper, Enpass, NordPass, RoboForm, Trezor Suite) and more terminal histories. A supplementary Python payload (https://escapeai.live/payload.py) adds VPN configs (ProtonVPN, Mullvad, NordVPN, ExpressVPN, WireGuard), Slack/Signal/Zoom session databases, a Desktop/Documents/Downloads file grabber (.txt, .pdf, .docx, .xlsx, .json, .csv, .key) and Netscape-format cookie conversion for session hijacking.

SOCRadar describes GlowComa as financially motivated, active since January 2026, present on the XSS, Exploit.in and Rehub forums (with multiple Exploit.in arbitration disputes over poor conversion rates and fast detection), and contactable via the TOX aliases @ObjectCollision, @SaykatChain and @layer7king. The service bundles the ICARUS ClickFix panel with a multi-chain crypto clipper and is affiliated with the MADHASH crypto-draining group; developer updates are posted on the Telegram channel t.me/s/icmacos. Subscriptions are priced at $699 weekly, $1,199 biweekly and $1,699 monthly (discounted to $899 for ICARUS ClickFix users) and include a Go/MySQL web panel, build analytics, custom VPS integration and Telegram alerts. No CVE or vendor-assigned severity applies; the HIGH severity is the analyst's judgment. No BeaconBeagle matches were found: the IP lookups returned 404 and the escapeai.live config search returned zero results. Note: the Huntress-reported Go-based macOS ClickFix stealer covered by BleepingComputer (2026-08-06, Aeza AS210644 infrastructure) is a separate, unattributed campaign and is cited only as context, not as ICMacOS.