A new macOS Remote Access Trojan (RAT) called ICMacOS—also known as Icarus macOS—is being advertised on Russian-language dark web forums for a steep $699 per week. The malware, initially acting mainly as a data stealer, has evolved in recent months to include full remote access capabilities, allowing continuous control and long-term persistence on infected Apple machines.
How ICMacOS Infects and Stays Undetected
Identified by SOCRadar in September 2026, ICMacOS starts its infection via fake websites that trick users into copying a command into the Terminal. That command downloads a “dropper” script which hides terminal activity, then displays a deceptive System Preferences popup requesting the user’s login password. The dropper verifies login credentials against the Keychain, allows up to five attempts, determines whether the Mac uses Apple Silicon or Intel, then fetches the appropriate payload. These tactics mimic earlier macOS threats, such as the “fake disk cleanup” campaign.
The latest version introduces new stealthy features: it maintains a live WebSocket connection to allow operators to send and execute commands via \bin/sh, with results sent back in real time. ICMacOS also establishes persistence with a LaunchAgent disguising itself as a legitimate Apple process (“com.apple.systemupdater.plist”), restarts automatically if stopped, and runs as a backup every hour. To avoid detection or legal risk, it includes logic to self-terminate on Macs set to Russian or other CIS-region languages or public IP addresses.
What’s at Risk—Especially for Developers and Executives
ICMacOS can harvest an extensive array of data: browser passwords and cookies; crypto wallets; Keychain contents; browser extensions; messaging platforms like Telegram, WhatsApp, and Discord. For people in development, the stakes are higher: it attempts to grab SSH keys, AWS and Kubernetes credentials, Git config and credentials, and environment files. This could allow attackers to infiltrate codebases, cloud infrastructures, or even customer data.
GlowComa, the alias used by the actor behind ICMacOS, has been operating since early 2026. It’s linked to the affiliate group MADHASH, known for crypto asset draining. Researchers note that compared to other RATs for Mac—like AMOS, Banshee, and MacSync—ICMacOS is priced much lower. While those tools can cost thousands per month, ICMacOS is accessible at hundreds per week. That affordability makes it attractive to less sophisticated threat actors.
Signs of Infection & How to Stay Safe
Some indicators of compromise (IoCs) include the domain escapeai[.]live, which handles login, payload delivery, and command-and-control. Other suspicious domains include mikoblico[.]xyz, along with a series of IPs, URLs and SHA256 hashes associated with different versions of the dropper and payload. Users are also warned that files may hide in ~/Library/LaunchAgents/com.apple.systemupdater.plist or in temporary directories like /tmp/.update-helper.log.
To defend against this threat, Mac users should avoid copying and pasting Terminal commands from websites, only install software from verified sources, and pay attention to Apple’s warnings before running risky commands. Developers and executives—who often hold high-value credentials and keys—need to be especially cautious about account breaches via compromised laptops.
What this means moving forward: ICMacOS marks a dangerous escalation in Mac-targeted malware. Stepping beyond mere data theft, its remote access and persistence tools allow long-term footholds in victim systems. Mac users have historically felt safer from malware than Windows users—this breaks the narrative. Companies and individuals alike must rethink trust boundaries: vet terminal commands, scrutinize process names, and monitor for unusual network behavior. The threat landscape is shifting, and every Mac could be a doorway.
