ICMacOS Expands Into Persistent Mac RAT Sold for $699 a Week

ICMacOS, also known as Icarus macOS, has evolved from an information stealer into a persistent remote-access trojan marketed for $699 per week on Russian-speaking underground forums. The seller, GlowComa, promotes the malware under the MADHASH crypto-draining affiliate group. Infections begin with deceptive websites that persuade users to paste commands into Terminal, followed by a fake password prompt and delivery of a payload tailored to the Mac’s processor architecture. The malware avoids systems in Russia and other Commonwealth of Independent States countries.

Version 2 adds interactive command execution over WebSocket and LaunchAgent persistence, while retaining the ability to steal browser credentials, cryptocurrency wallets, Keychain data, and developer secrets. The combination of ongoing remote access and credential theft creates risks beyond individual Macs: compromised developer credentials could enable follow-on access to corporate code repositories and cloud environments. Defenders should prioritize detection of suspicious Terminal activity, unexpected LaunchAgents, and anomalous outbound WebSocket connections, and revoke exposed credentials when compromise is identified.