ICMacOS

ICMacOS, also known as Icarus macOS, is a macOS information-stealing malware family that has evolved to include persistent remote-access trojan capabilities. Identified in September 2026, it is developed and promoted as malware-as-a-service by the financially motivated, Russian-speaking actor GlowComa. Its Go-based payloads target both Intel and Apple Silicon Macs.

Infections use ClickFix pages to persuade victims to paste malicious commands into Terminal. A staged installation process displays a spoofed macOS password dialog, validates the captured password against the login Keychain, and downloads an architecture-specific payload. The installation chain conceals Terminal activity and launches the malware in the background.

ICMacOS collects browser passwords, cookies, session artifacts, browsing history, password-manager data, cryptocurrency wallets, and macOS Keychain contents. It also targets messaging applications, personal documents, clipboard contents, and developer secrets, including SSH keys, cloud credentials, container authentication data, and Kubernetes configurations. A supplementary Python payload extends collection to VPN configurations, additional communications applications, and documents. Collected information is compressed into hidden archives and exfiltrated over HTTPS. Stolen cookies and application session material can facilitate session hijacking, while developer credentials can expose enterprise infrastructure beyond the infected Mac.

The second version adds LaunchAgent persistence and an interactive WebSocket command channel that executes shell commands and returns output in real time. Persistent access enables repeated collection of newly available credentials and other sensitive data. The malware also gathers host information and performs locale and geographic checks intended to exclude Russia and other Commonwealth of Independent States countries.