ICMacOS: the $699-a-Week Mac Infostealer That Became a Remote Access Trojan

A macOS malware kit known as ICMacOS, also advertised as Icarus macOS, is being rented out on Russian-language underground forums for $699 a week. It started life as a run-of-the-mill infostealer, but its second version now hides on the machine, survives reboots and executes commands sent by its operators in real time. For a platform that many developers and executives trust by default, that is a meaningful shift.

What is being sold

The kit first surfaced in September 2026 and was documented in detail in mid-October. The seller operates under the handle GlowComa, a financially motivated actor active since January 2026, and markets the tool under the banner of a crypto-draining affiliate crew called MADHASH.

Price is the headline. At $699 a week, ICMacOS appears to be the cheapest macOS stealer currently on offer. Historical asking prices for other Mac stealers have reportedly been far higher: AMOS at around $3,000 a month, Banshee between $1,500 and $3,000 a month, and MacSync between $1,000 and $1,500 a month. The low price lowers the barrier to entry for less sophisticated criminals, even if the seller has a mixed reputation on the underground, with several forum disputes over poor results and slow support.

How an infection starts

Delivery is a classic ClickFix-style lure. Victims land on a fake web page that convinces them to copy a command and paste it into Terminal. That command pulls down a dropper script which hides the Terminal window and pops a counterfeit System Preferences dialog asking for the Mac login password.

The dropper does not simply trust what is typed. It validates the password against the login Keychain and allows up to five attempts before moving on. It then fingerprints the hardware, Apple Silicon or Intel, and downloads the matching payload.

Version 2: from stealer to remote access

Version 2 keeps all of the theft modules and adds a persistent WebSocket connection back to the operator's server. Over that channel, criminals can push commands that execute through /bin/sh and receive the output immediately. In practice, the stealer has become a remote access trojan.

Persistence is handled by a LaunchAgent named com.apple.systemupdater.plist, chosen to blend in with legitimate Apple components. The agent restarts the malware if it is killed and re-runs it every 60 minutes as a fallback.

The malware also avoids certain victims. It checks the system language and the public IP geolocation, and shuts down on machines in Russia and other CIS countries, a common tell for financially motivated crews operating from that region.

Why developers should care

ICMacOS harvests a wide range of data: browser passwords and cookies, cryptocurrency wallets, 29 browser extensions, Keychain contents and messaging data from Telegram, WhatsApp and Discord.

The part that should worry security teams is its developer focus. The malware specifically hunts for SSH keys, AWS and Kubernetes configuration, Git credentials and .env files. Those are the secrets that turn a single compromised laptop into a path into source code, cloud environments and, ultimately, customers. Macs are the default workstation for a large share of engineers and executives, which makes them an unusually rich target for exactly this kind of collection.

What to do

• Never paste a command from a website into Terminal, no matter how convincing the page looks. Apple now warns on some risky pasted commands, but the protection does not cover every case.
• Install software only from verified sources, and treat unexpected "fix" or "update" instructions as hostile.
• Hunt for the persistence artifact. Search user LaunchAgents folders for com.apple.systemupdater.plist and the hidden log and staging files listed below.
• Rotate anything a developer Mac could have held: SSH keys, cloud access keys, Kubernetes credentials, Git tokens and secrets from .env files. Enforce short-lived credentials wherever possible.
• Block the indicators below at the DNS and proxy layer and push the hashes to your EDR.

Stolen credentials from kits like this usually end up resold on the same underground markets where the malware itself is advertised. Continuous Deep/Dark Web monitoring, the kind our team runs for clients, gives you a chance to spot leaked developer and cloud credentials and rotate them before someone else uses them.

Indicators of compromise

All indicators are defanged. Restore them only inside your threat intelligence platform or SIEM.