Threat reportMalwareTL-2026-4508
ICMacOS (Icarus macOS) Remote Access Trojan and Infostealer Sold as MaaS at $699/Week Targeting Mac Users
ICMacOS (Icarus macOS) Remote Access Trojan and Infostealer (TL-2026-4508), also tracked as Icarus macOS, is a high-severity malware campaign, first published 2026-10-27. It is attributed to GlowComa with medium confidence, affects Apple macOS, maps to 17 MITRE ATT&CK techniques (T1036.005, T1056.002, T1059.002), and is covered by 9 detection rules and 39 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 1GlowComa
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 39Indicators of compromise
Key facts for TL-2026-4508
- Threat ID
- TL-2026-4508
- Also known as
- Icarus macOS, ICMacOs
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- GlowComa
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, cryptocurrency, finance, general consumers
- Target regions
- Global (excluding Russia and CIS via geo-fencing)
- Detection rules
- 9
- Indicators of compromise
- 39
Malware and tooling in ICMacOS (Icarus macOS) Remote Access Trojan and Infostealer
Malware and tooling: ICMacOS
How ICMacOS (Icarus macOS) Remote Access Trojan and Infostealer works
ICMacOS is a Go-based macOS infostealer that evolved into a persistent RAT, sold as malware-as-a-service by the Russian-speaking actor GlowComa (MADHASH crypto-draining affiliate banner). It is delivered through ClickFix-style pages that make victims paste commands into Terminal, phishes the user password with a fake System Preferences dialog validated against the login Keychain, and steals browser, wallet, messaging and developer credentials.
ICMacOS (also called Icarus macOS) was identified by the SOCRadar Threat Research Unit in September 2026 and detailed in a report published on 2026-10-12. It has been marketed since early September 2026 on Russian-speaking cybercrime forums (XSS, Exploit.in, Rehub) by the persona GlowComa, a financially motivated actor active since January 2026 that operates under the MADHASH crypto-draining affiliate banner. Subscriptions are priced at $699/week, $1,199 biweekly and $1,699/month (discounted to $899 for existing Icarus ClickFix customers). It is promoted as part of a broader ICARUS suite that includes an ICARUS ClickFix social-engineering panel and a multi-chain crypto clipper. Reported seller handles are @ObjectCollision, @SaykatChain and @layer7king, with a Telegram promotion channel. The operator panel is a Go backend with MySQL storage, build analytics, custom VPS integration and Telegram notifications.
Infection chain: a ClickFix-style fake web page instructs the victim to paste a command into Terminal. The initial bash script fetches a campaign-specific dropper (escapeai[.]live/icmacos_run_v2.command, saved to /tmp, executed with build-specific parameters; a loader_v2.sh endpoint with build and owner parameters is also referenced). The dropper modifies com.apple.Terminal preferences to hide window titles and uses osascript to show a spoofed System Preferences password dialog (5 attempts). Each password is validated with 'security unlock-keychain -p <password> ~/Library/Keychains/login.keychain-db'; the verified plaintext password is kept and passed to the payload. The dropper checks 'uname -m', downloads the arm64 or amd64 Mach-O from escapeai[.]live/ICMacOs?arch=..., stages it as /tmp/.update-tmp/ICMacOs.gz, launches it through osascript and nohup with the stolen password, build name and owner ID, runs 'killall Terminal' and shows a customizable fake error dialog. Activity is logged to hidden files /tmp/.update-helper.log (dropper) and /tmp/.cache-update.log (stealer). Geo-fencing halts execution when a Russian locale (ru_RU) or a CIS public-IP country (via ipinfo.io/country) is detected.
The payload is a 64-bit Go Mach-O supporting macOS Sierra (10.12) onward on x86_64 and ARM64. Version 1 is a one-shot stealer: Chromium-family, Safari and Firefox/Waterfox credentials, cookies, history; 29 browser extensions (wallets such as MetaMask, Phantom, Coinbase, Trust, Rabby, Keplr, Ronin, TronLink and password managers 1Password, Bitwarden, LastPass, Dashlane); about 20 desktop wallets (Electrum, Exodus, Ledger Live, etc.); login Keychain via an embedded keychainbreaker library with a fallback to 'security dump-keychain -d' and an osascript admin prompt; Telegram tdata, WhatsApp, Discord tokens and iMessage chat.db; Apple Notes; SSH keys, AWS, Git, GitHub CLI, Kubernetes, Docker, gcloud and Terraform credentials, recursive .env* files, Termius configs and shell histories. Data is compressed into a hidden ZIP (e.g. /tmp/.systemd-private-helper.zip), POSTed as multipart/form-data over HTTPS to escapeai[.]live/upload, and a Telegram alert is sent to the operator.
Version 2 adds RAT functionality: process de-confliction with pgrep ICMACOS and kill -SIGKILL, privilege assessment (root vs wheel), LaunchAgent persistence at ~/Library/LaunchAgents/com.apple.systemupdater.plist (Label com.apple.systemupdater, KeepAlive true, StartInterval 3600, registered with launchctl bootstrap gui/<uid>), and a Gorilla WebSocket C2 channel at wss://escapeai[.]live/ws?mac_id={hostname}&username={username} that receives text instructions, runs them via /bin/sh and streams stdout/stderr back. It also adds Steam (loginusers.vdf, .ssfn), Outlook data, clipboard via pbpaste, browser autofill, more password managers, and a Python payload (escapeai[.]live/payload.py) that grabs VPN configs (ProtonVPN, Mullvad, NordVPN, ExpressVPN, WireGuard), Slack/Signal/Zoom data and documents from Desktop/Documents/Downloads, and converts cookies to Netscape format for session hijacking.
Impact: developer workstations are especially exposed because stolen SSH keys, cloud credentials, Kubernetes configs and .env files can give access to source code, cloud environments and customers. No CVE is involved; the attack relies on user-executed commands. Severity is analyst-assigned. Attribution to GlowComa rests on the SOCRadar report; the BeaconBeagle API returned no beacon or config matches for 85.137.253.61 or escapeai.live at research time.
MITRE ATT&CK techniques used in TL-2026-4508
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1480 Execution Guardrails; T1564 Hide Artifacts
Credential Access
T1056.002 GUI Input Capture; T1552.001 Credentials In Files; T1552.003 Shell History; T1555.001 Keychain; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1059.006 Python; T1204.004 Malicious Copy and Paste
Command and Control
Discovery
T1082 System Information Discovery
Persistence
Collection
Affected products and versions in ICMacOS (Icarus macOS) Remote Access Trojan and Infostealer
- Apple — macOS
Vulnerable versions: macOS 10.12 Sierra and later, Intel (x86_64) and Apple Silicon (ARM64)
Remediation for ICMacOS (Icarus macOS) Remote Access Trojan and Infostealer
Immediate actions
- Block escapeai.live and mikoblico.xyz and IPs 85.137.253.61 and 45.13.186.247 at DNS, proxy and firewall, including WebSocket (wss) traffic
- Hunt macOS fleet for ~/Library/LaunchAgents/com.apple.systemupdater.plist and the /tmp/.update-helper.log, /tmp/.cache-update.log, /tmp/.update-tmp/ and /tmp/.systemd-private-helper.zip artifacts
- If a host is infected, treat the user password, Keychain, browser sessions, SSH keys, cloud/Git tokens and wallet seeds as compromised: rotate credentials, revoke sessions and API keys, and reimage the host
Workarounds
- Restrict Terminal use and unmanaged software installation on managed Macs through MDM policy
- Alert on newly created LaunchAgents with Apple-mimicking labels
Longer-term hardening
- Train users and developers not to paste commands from websites into Terminal (ClickFix-style lures)
- Deploy macOS EDR with detection for osascript password prompts, security unlock-keychain usage and unsigned LaunchAgents
- Keep long-lived cloud and Git credentials out of plaintext files and .env files; prefer short-lived tokens and hardware-backed keys
Timeline of ICMacOS (Icarus macOS) Remote Access Trojan and Infostealer
- GlowComa, a financially motivated Russian-speaking actor under the MADHASH crypto-draining affiliate banner, is reported active since January 2026 (exact day not stated in sources)
- ICMacOS begins to be marketed on XSS, Exploit.in and Rehub from early September 2026 at $699/week, $1,199 biweekly and $1,699/month (exact day not stated in sources)
- SOCRadar Threat Research Unit identifies ICMacOS in September 2026 (exact day not stated; mid-month placeholder date)
- SOCRadar publishes 'Inside ICMacOS: From an Infostealer to a Persistent RAT', documenting Version 1 (stealer) and Version 2 (RAT with WebSocket C2 and LaunchAgent persistence)
- BeaconBeagle lookups at research time returned no beacon or config matches for 85.137.253.61 or escapeai.live; infrastructure remains unconfirmed as a known C2 framework deployment
- Cyber Security News reports on ICMacOS being sold as MaaS for $699/week and lists IOCs and defensive recommendations
Sources cited for ICMacOS (Icarus macOS) Remote Access Trojan and Infostealer
Detection coverage for TL-2026-4508
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4508 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4508
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.