INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

ICMacOS Infostealer turns into Persistent RAT via Dark Web

| 2026-10-27 12:15 LOW MEDIUM DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
ICMacOS (Icarus macOS) is a newly identified macOS Malware-as-a-Service stealer actively marketed since September 2026 by the Russian-speaking actor GlowComa on underground forums. The malware targets macOS systems running Sierra through current versions on both Intel and Apple Silicon architectures. Initially designed as a credential stealer, it rapidly evolved into a persistent remote access trojan with WebSocket-based command-and-control capabilities. The infection chain uses ClickFix social engineering to deliver dropper scripts that harvest administrator passwords through fake system dialogs before deploying the primary payload.
Technical Mitigations AI-generated
• Block WebSocket-based command-and-control connections to prevent ICMacOS RAT functionality. • Use a secure password manager and enable two-factor authentication for all accounts targeted by the malware. • Regularly scan systems running Sierra through current versions on both Intel and Apple Silicon architectures for AMOS, MacSync, Cthulhu, and other variants of Icarus macOS.
Technical Observables 22 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 22 IoCs Create Free Account
urls 1 sha256 16 domains 3 ips 2
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope cryptocurrencycryptocurrency
Incident Timeline
‎September 2026
GlowComa, a Russian-speaking actor, actively marketed ICMacOS, an Infostealer that evolved into a Persistent RAT, since September 2026.
source_region Russian Federation
Inside ICMacOS: From an Infostealer to a Persistent RAT. ICMacOS (Icarus macOS) is a newly identified macOS Malware-as-a-Service stealer actively marketed since September 2026 by the Russian-speaking actor GlowComa on underground forums.
infrastructure Macos
Inside ICMacOS: From an Infostealer to a Persistent RAT. ICMacOS (Icarus macOS) is a newly identified macOS Malware-as-a-Service stealer actively marketed since September 2026 by the Russian-speaking actor GlowComa on underground forums.
The malware targets macOS systems running Sierra through current versions on both Intel and Apple Silicon architectures.
organisation Infostealer
Inside ICMacOS: From an Infostealer to a Persistent RAT. ICMacOS (Icarus macOS) is a newly identified macOS Malware-as-a-Service stealer actively marketed since September 2026 by the Russian-speaking actor GlowComa on underground forums.
tactic T1588.001 - Malware
Inside ICMacOS: From an Infostealer to a Persistent RAT. ICMacOS (Icarus macOS) is a newly identified macOS Malware-as-a-Service stealer actively marketed since September 2026 by the Russian-speaking actor GlowComa on underground forums.
organisation Sierra
The malware targets macOS systems running Sierra through current versions on both Intel and Apple Silicon architectures.
organisation Intel
The malware targets macOS systems running Sierra through current versions on both Intel and Apple Silicon architectures.
organisation Apple Silicon
The malware targets macOS systems running Sierra through current versions on both Intel and Apple Silicon architectures.
organisation ClickFix
The infection chain uses ClickFix social engineering to deliver dropper scripts that harvest administrator passwords through fake system dialogs before deploying the primary payload.
organisation WebSocket
Initially designed as a credential stealer, it rapidly evolved into a persistent remote access trojan with WebSocket-based command-and-control capabilities.
organisation Outlook
Version 2 introduces full RAT functionality with LaunchAgent persistence and interactive shell access while expanding data collection to include Steam accounts, Outlook data, and additional password managers.
Tactical Metrics
Metrics
infrastructure
‎Macos
Affected Product
Inside ICMacOS: From an Infostealer to a Persistent RAT. ICMacOS (Icarus macOS) is a newly identified macOS Malware-as-a-Service stealer actively marketed since September 2026 by the Russian-speaking actor GlowComa on underground forums.
The malware targets macOS systems running Sierra through current versions on both Intel and Apple Silicon architectures.
Intelligence Sources
AlienVault OTX 2026-10-27