GlowComa

GlowComa is a financially motivated, Russian-speaking cybercriminal actor active since January 2026 and associated with the MADHASH cryptocurrency-draining affiliate group. The actor develops and distributes ICMacOS, also known as Icarus macOS, as a subscription-based malware-as-a-service offering. GlowComa promotes the malware on Russian-language cybercrime forums including XSS, Exploit.in, and Rehub, and distributes updates through Telegram. Its offerings also include an Icarus ClickFix social-engineering panel and a multi-chain cryptocurrency clipper. ICMacOS targets Intel and Apple Silicon Macs, combining information theft with persistent remote access. Its infection chain uses ClickFix pages to persuade victims to execute malicious Terminal commands, followed by spoofed macOS password dialogs that capture and validate the user's login password. Architecture-specific payloads collect browser credentials and session cookies, Keychain contents, cryptocurrency wallets, password-manager data, messaging sessions, personal documents, and developer secrets such as SSH keys, cloud credentials, and Kubernetes configurations. Collected data is archived and exfiltrated over HTTPS. The malware's second version adds LaunchAgent persistence and an interactive WebSocket command channel for shell execution and real-time output. It conceals Terminal activity, impersonates Apple components, and implements geographic exclusion checks intended to avoid Russia and other Commonwealth of Independent States countries. Persistent access supports repeated collection of newly available credentials and session material. Stolen developer secrets create potential pathways into enterprise infrastructure, although specific downstream compromises and victim sectors are not established.