ICMacOS RAT sold for $699 a week to target Mac users
Key Takeaways The ICMacOS (Icarus macOS) Remote Access Trojan (RAT) is actively sold on Russian-speaking dark web forums for $699 per week. Initially an infostealer, ICMacOS has evolved into a...
Key Takeaways
- The ICMacOS (Icarus macOS) Remote Access Trojan (RAT) is actively sold on Russian-speaking dark web forums for $699 per week.
- Initially an infostealer, ICMacOS has evolved into a full-fledged RAT, capable of persistence, remote command execution, and sophisticated data exfiltration on macOS systems.
- The malware targets a broad range of sensitive data, including browser credentials, cryptocurrency wallets, and critical developer secrets like SSH keys and cloud configurations.
- The threat actor, “GlowComa,” is part of the MADHASH crypto-draining affiliate group, indicating a clear financial motivation.
- Users should exercise extreme caution with Terminal commands and software downloads, as no direct patch is available for this malware.
A potent new macOS malware, known as ICMacOS or Icarus macOS, is being actively marketed on underground Russian-language forums for $699 weekly. This sophisticated tool has evolved beyond its origins as a basic infostealer to become a full-fledged Remote Access Trojan (RAT), posing a significant threat to Mac users.
Table Of Content
First identified by SOCRadar’s Threat Research Unit in September 2026, a detailed analysis was published on October 12. The malware’s capabilities now include stealthy persistence across reboots and the ability to execute remote commands, granting attackers extensive control over compromised systems.
The Actor Behind the Threat
The vendor, operating under the moniker “GlowComa,” has been active since January 2026 and is associated with the financially motivated MADHASH crypto-draining affiliate group. This connection underscores the malware’s primary objective: illicit financial gain through data theft and system compromise.
Researchers at Moonlock Lab also noted that ICMacOS stands out as the most economically priced macOS stealer available on the dark web. Their report, which references SOCRadar’s findings, highlights the comparative affordability of ICMacOS against other macOS threats.
For context, rival Mac malware strains command significantly higher prices: AMOS has been reported at $3,000 per month, Banshee between $1,500 and $3,000 monthly, and MacSync from $1,000 to $1,500 per month. These figures are based on historical pricing data. Despite its competitive pricing, GlowComa reportedly has a mixed reputation within the underground community, with several complaints on Exploit.in regarding subpar performance and slow service delivery, as documented in a technical report.
ICMacOS Remote Access Trojan Capabilities
The infection chain for ICMacOS typically begins with deceptive web pages. These sites trick users into copying and executing a malicious command in their Terminal application. This command then downloads a dropper script. The dropper conceals the Terminal window and presents a counterfeit System Preferences prompt, coercing the user into entering their login password. It attempts to validate this password against the login Keychain up to five times.
Crucially, the dropper intelligently identifies whether the target Mac runs on Apple Silicon or an Intel processor, subsequently downloading the appropriate malicious payload. This tactic mirrors the fake disk cleanup campaigns observed by Microsoft researchers since January.
Evolution to Version 2 and Persistence
Version 2 of ICMacOS significantly enhances its capabilities. While retaining its data theft modules, it establishes a persistent WebSocket connection to the attacker’s command-and-control (C2) server. This live connection enables operators to issue commands via /bin/sh and receive real-time output, affording them direct and immediate control over the compromised machine.
To ensure persistence, the malware installs a LaunchAgent named com.apple.systemupdater.plist. This name is deliberately chosen to mimic a legitimate Apple process, aiding in evasion. The LaunchAgent is configured to automatically restart the malware if it terminates and to re-execute it every 60 minutes as a fallback. Such evasion techniques have proven effective against Apple’s security checks, as detailed in analyses of signed app Gatekeeper bypasses.
ICMacOS also incorporates geo-fencing capabilities. It checks the system language and the victim’s public IP address, halting execution on systems located in Russia and other CIS countries. While its core objective remains financial and data theft, the added remote access functionality allows attackers to maintain a prolonged presence within compromised environments, maximizing their illicit gains.
Developer Secrets at High Risk
The scope of data targeted by ICMacOS is extensive, including browser passwords and cookies, cryptocurrency wallets, data from 29 browser extensions, Keychain entries, and messages from applications like Telegram, WhatsApp, and Discord.
However, developers face a particularly elevated risk due to the malware’s specific search for sensitive development-related data. This includes SSH keys, AWS and Kubernetes configuration files, Git credentials, and .env files. Umut Bayram of Picus Security warns that “one compromised laptop can open a path into a company’s code, cloud systems, and customers.” Kevin M. Coles of Coles Technical Group further emphasizes that “developers and executives use Macs often, and those machines hold SSH keys, cloud logins, and crypto wallets.”
What You Should Do
- Never Paste Unknown Commands: Avoid copying and pasting commands from unverified websites directly into your Terminal. Always understand what a command does before executing it.
- Download from Trusted Sources: Only download software from official app stores or directly from trusted vendor websites.
- Enable Full Disk Encryption: Ensure FileVault is enabled to encrypt your Mac’s startup disk, protecting data at rest.
- Regularly Back Up Data: Maintain up-to-date backups of all critical data to an external drive or cloud service.
- Review App Permissions: Periodically check and restrict unnecessary permissions for applications in System Settings > Privacy & Security.
- Educate Users: For organizations, conduct regular cybersecurity awareness training, especially for developers and executives, on phishing, social engineering, and safe computing practices.
- Implement Endpoint Detection and Response (EDR): Deploy robust EDR solutions capable of detecting and responding to suspicious activities on macOS endpoints.
- Monitor Network Traffic: Keep an eye on outbound network connections for unusual activity that might indicate C2 communication.
Indicators of Compromise (IoCs)
| Type | Indicator | Description |
|---|---|---|
| Domain | escapeai[.]live | ICMacOS login, payload delivery, and C2 |
| Domain | mikoblico[.]xyz | ICMacOS login |
| IP Address | 85.137.253[.]61 | ICMacOS login |
| IP Address | 45.13.186[.]247 | ICMacOS login |
| URL | hxxps[://]escapeai[.]live/api/build_config | ICMacOS build downloader URL |
| URL | hxxps[://]escapeai[.]live/icmacos_run_v2[.]command?t={date} | ICMacOS downloader URL |
| URL | hxxp[://]escapeai[.]live/loader_v2[.]sh?build={build_name}&owner={owner} | ICMacOS downloader URL |
| URL | hxxps[://]escapeai[.]live/ICMacOs?arch=arm64 | Payload delivery for Apple Silicon |
| URL | hxxps[://]escapeai[.]live/ICMacOs?arch=amd64 | Payload delivery for Intel |
| URL | hxxps[://]escapeai[.]live/payload[.]py | Python payload delivery URL |
| URL | hxxps[://]escapeai[.]live/upload | Stolen data upload (exfiltration) |
| WebSocket URL | wss[://]escapeai[.]live/ws?mac_id={hostname}&username={username} | Interactive C2 channel |
| LaunchAgent | ~/Library/LaunchAgents/com.apple.systemupdater.plist | Persistence |
| File path | /tmp/.update-helper.log | Hidden execution log |
| File path | /tmp/.cache-update.log | Hidden execution log |
| File path | /tmp/.update-tmp/ICMacOs.gz | Downloaded compressed payload |
| File path | /tmp/.systemd-private-helper.zip | Collected data archive example |
| SHA256 | 5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8 | ICMacOS dropper |
| SHA256 | 8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a | ICMacOS dropper |
| SHA256 | 62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17 | ICMacOS dropper |
| SHA256 | 857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0 | ICMacOS dropper |
| SHA256 | 6917505bbdc8efa01ea1a0298eae62a93a57a8c98d3712a69d822dca4a667f05 | ICMacOS dropper |
| SHA256 | dca852b53c259641e1782bd9122c5007130614a7a8fd17102400acb4f50f6e94 | ICMacOS dropper |
| SHA256 | e7e8ac14aaee970c6d00c6cbb398decc56dfc128974c01bfc8e7acd13a18576e | ICMacOS dropper |
| SHA256 | ec37acd3bd15f50eee2941d5644ca0ee738b36ce4a39e9e08058e35ebc7961fc | ICMacOS dropper |
| SHA256 | fcf9de13ecc70b4fda3998ed7a93849edf86c48767a1a13f32f4a6a631a65ae2 | ICMacOS dropper |
| SHA256 | 3d4f70172c8f31813e7b37fc1a49bce193663e33c4eb65952bb5aec9d7176826 | ICMacOS dropper |
| SHA256 | 8b7606bdccdd6ff691db875283fdf5
Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.
|
No Comment! Be the first one.