MADHASH

MADHASH is a financially motivated cryptocurrency-draining affiliate group associated with the malware developer and distributor GlowComa. Operating under the MADHASH banner, GlowComa markets the ICARUS suite, including the ICMacOS information stealer and remote-access malware, a ClickFix social-engineering panel, and a multi-chain cryptocurrency clipper. These offerings are promoted through Russian-language cybercriminal forums using a subscription-based malware-as-a-service model. Russian-language activity does not establish the group's country of origin. ICMacOS, also known as Icarus macOS, targets Intel and Apple Silicon Macs. Its infection chain uses ClickFix pages to persuade victims to execute malicious Terminal commands, followed by a spoofed macOS password dialog that captures and validates the user's login password. The malware steals browser credentials and cookies, Keychain contents, cryptocurrency wallet data, password-manager records, messaging session artifacts, personal documents, and developer secrets such as SSH keys and cloud credentials. Collected data is archived and exfiltrated over HTTPS. An expanded ICMacOS variant establishes persistence through LaunchAgents and supports interactive remote shell execution over WebSocket, enabling continued access and repeated collection. Its defense-evasion measures include concealing Terminal activity and impersonating Apple components. Supplementary Python tooling broadens collection to VPN configurations, collaboration applications, and documents. GlowComa is an associated developer and distributor, not an established alias for MADHASH.