# ICMacOS (Icarus macOS) Remote Access Trojan and Infostealer Sold as MaaS at $699/Week Targeting Mac Users

> ICMacOS is a Go-based macOS infostealer that evolved into a persistent RAT, sold as malware-as-a-service by the Russian-speaking actor GlowComa (MADHASH crypto-draining affiliate banner). It is delivered through ClickFix-style pages that make victims paste commands into Terminal, phishes the user password with a fake System Preferences dialog validated against the login Keychain, and steals browser, wallet, messaging and developer credentials.

- **Published:** 2026-10-27T04:05:13Z
- **Last reviewed:** 2026-10-27T04:05:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4508
- **ID:** TL-2026-4508
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** GlowComa
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ICMacOS (also called Icarus macOS) was identified by the SOCRadar Threat Research Unit in September 2026 and detailed in a report published on 2026-10-12. It has been marketed since early September 2026 on Russian-speaking cybercrime forums (XSS, Exploit.in, Rehub) by the persona GlowComa, a financially motivated actor active since January 2026 that operates under the MADHASH crypto-draining affiliate banner. Subscriptions are priced at $699/week, $1,199 biweekly and $1,699/month (discounted to $899 for existing Icarus ClickFix customers). It is promoted as part of a broader ICARUS suite that includes an ICARUS ClickFix social-engineering panel and a multi-chain crypto clipper. Reported seller handles are @ObjectCollision, @SaykatChain and @layer7king, with a Telegram promotion channel. The operator panel is a Go backend with MySQL storage, build analytics, custom VPS integration and Telegram notifications.

Infection chain: a ClickFix-style fake web page instructs the victim to paste a command into Terminal. The initial bash script fetches a campaign-specific dropper (escapeai[.]live/icmacos_run_v2.command, saved to /tmp, executed with build-specific parameters; a loader_v2.sh endpoint with build and owner parameters is also referenced). The dropper modifies com.apple.Terminal preferences to hide window titles and uses osascript to show a spoofed System Preferences password dialog (5 attempts). Each password is validated with 'security unlock-keychain -p <password> ~/Library/Keychains/login.keychain-db'; the verified plaintext password is kept and passed to the payload. The dropper checks 'uname -m', downloads the arm64 or amd64 Mach-O from escapeai[.]live/ICMacOs?arch=..., stages it as /tmp/.update-tmp/ICMacOs.gz, launches it through osascript and nohup with the stolen password, build name and owner ID, runs 'killall Terminal' and shows a customizable fake error dialog. Activity is logged to hidden files /tmp/.update-helper.log (dropper) and /tmp/.cache-update.log (stealer). Geo-fencing halts execution when a Russian locale (ru_RU) or a CIS public-IP country (via ipinfo.io/country) is detected.

The payload is a 64-bit Go Mach-O supporting macOS Sierra (10.12) onward on x86_64 and ARM64. Version 1 is a one-shot stealer: Chromium-family, Safari and Firefox/Waterfox credentials, cookies, history; 29 browser extensions (wallets such as MetaMask, Phantom, Coinbase, Trust, Rabby, Keplr, Ronin, TronLink and password managers 1Password, Bitwarden, LastPass, Dashlane); about 20 desktop wallets (Electrum, Exodus, Ledger Live, etc.); login Keychain via an embedded keychainbreaker library with a fallback to 'security dump-keychain -d' and an osascript admin prompt; Telegram tdata, WhatsApp, Discord tokens and iMessage chat.db; Apple Notes; SSH keys, AWS, Git, GitHub CLI, Kubernetes, Docker, gcloud and Terraform credentials, recursive .env* files, Termius configs and shell histories. Data is compressed into a hidden ZIP (e.g. /tmp/.systemd-private-helper.zip), POSTed as multipart/form-data over HTTPS to escapeai[.]live/upload, and a Telegram alert is sent to the operator.

Version 2 adds RAT functionality: process de-confliction with pgrep ICMACOS and kill -SIGKILL, privilege assessment (root vs wheel), LaunchAgent persistence at ~/Library/LaunchAgents/com.apple.systemupdater.plist (Label com.apple.systemupdater, KeepAlive true, StartInterval 3600, registered with launchctl bootstrap gui/<uid>), and a Gorilla WebSocket C2 channel at wss://escapeai[.]live/ws?mac_id={hostname}&username={username} that receives text instructions, runs them via /bin/sh and streams stdout/stderr back. It also adds Steam (loginusers.vdf, .ssfn), Outlook data, clipboard via pbpaste, browser autofill, more password managers, and a Python payload (escapeai[.]live/payload.py) that grabs VPN configs (ProtonVPN, Mullvad, NordVPN, ExpressVPN, WireGuard), Slack/Signal/Zoom data and documents from Desktop/Documents/Downloads, and converts cookies to Netscape format for session hijacking.

Impact: developer workstations are especially exposed because stolen SSH keys, cloud credentials, Kubernetes configs and .env files can give access to source code, cloud environments and customers. No CVE is involved; the attack relies on user-executed commands. Severity is analyst-assigned. Attribution to GlowComa rests on the SOCRadar report; the BeaconBeagle API returned no beacon or config matches for 85.137.253.61 or escapeai.live at research time.

## MITRE ATT&CK

- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1059.006 Python
- T1543.001 Launch Agent
- T1036.005 Match Legitimate Resource Name or Location
- T1480 Execution Guardrails
- T1564 Hide Artifacts
- T1056.002 GUI Input Capture
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1555.005 Password Managers
- T1552.001 Credentials In Files
- T1552.003 Shell History
- T1082 System Information Discovery
- T1560 Archive Collected Data
- T1071.001 Web Protocols

## Sources

- [Inside ICMacOS: From an Infostealer to a Persistent RAT](https://socradar.io/blog/icmacos-infostealer-rat/)
- [Hackers Sell ICMacOS Remote Access Trojan for $699 a Week to Target Mac Users](https://cybersecuritynews.com/icmacos-remote-access-trojan/)
- [ICMacOS malware evolves (Cyber Security News)](https://cybersecuritynews.com/icmacos-malware-evolves/amp/)
- [macOS credential stealing (GBHackers)](https://gbhackers.com/macos-credential-stealing/amp/)
- [ICMacOS: Neue Mac-Malware stiehlt Zugangsdaten und ermöglicht Fernzugriff (BornCity)](https://borncity.com/news/icmacos-neue-mac-malware-stiehlt-zugangsdaten-und-ermoeglicht-fernzugriff/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4508