Hackers Sell ICMacOS Remote Access Trojan for $699 a Week to Target Mac Users

Cybercriminals are selling a Mac malware kit that can do far more than steal passwords. The tool, called ICMacOS or Icarus macOS, is offered for $699 a week on Russian-speaking dark web forums.

It began as a basic data stealer, but its newer version can stay hidden on a Mac, survive restarts, and run commands sent by its operators.

SOCRadar’s Threat Research Unit first identified the malware in September 2026 and published a detailed report on October 12.

The seller uses the name GlowComa, a financially motivated actor active since January 2026, who promotes the tool under the banner of the MADHASH crypto-draining affiliate group.

For more background on how the threat grew, read our detailed ICMacOS evolution report, which explains each change in order.

Researchers at Moonlock Lab also noted that ICMacOS is the most affordable macOS stealer sold on the dark web. Moonlock’s write-up, which quotes SOCRadar, compares the price with other Mac threats.

AMOS reportedly sells for $3,000 a month, Banshee for $1,500 to $3,000 a month, and MacSync for $1,000 to $1,500 a month.

These figures are based on historical reported prices. The seller also has a mixed reputation in the underground market, with several disputes on Exploit.in over poor results and slow service.

Hackers Sell ICMacOS Remote Access Trojan

The infection starts with fake web pages that trick victims into copying a command and pasting it into Terminal. The command downloads a dropper script that hides the Terminal window and shows a fake System Preferences prompt asking for the login password.

The dropper checks that password against the login Keychain and allows up to five tries. It then checks whether the Mac uses Apple Silicon or Intel and downloads the matching payload.

This lure style is similar to the fake disk cleanup campaign that Microsoft researchers have tracked since January. The biggest change is in Version 2. It keeps the theft modules but adds a live WebSocket connection to the attacker’s server.

Operators can then send commands that run through /bin/sh, and the output returns in real time. The malware also installs a LaunchAgent named com.apple.systemupdater.plist, a name chosen to look like a normal Apple process.

It restarts automatically if it stops and runs again every 60 minutes as a backup. Similar tricks have helped other threats get past Apple’s checks, as described in our signed app Gatekeeper bypass coverage.

The malware is also built to avoid certain victims. It checks the system language and the victim’s public IP location, and it stops running on systems in Russia and other CIS countries.

Its main goal stays the same, which is to steal money and data, but the remote access feature lets criminals stay inside longer.

Why Developer Secrets Are at Risk

ICMacOS collects a wide range of data. It targets browser passwords and cookies, cryptocurrency wallets, 29 browser extensions, Keychain data, and messaging apps such as Telegram, WhatsApp, and Discord.

Developers face the greatest risk because the malware searches for SSH keys, AWS and Kubernetes settings, Git credentials, and .env files.

Picus Security’s Umut Bayram warned that one compromised laptop can open a path into a company’s code, cloud systems, and customers.

Kevin M. Coles of Coles Technical Group added that developers and executives use Macs often, and those machines hold SSH keys, cloud logins, and crypto wallets.

Mac users can lower their risk with a few simple habits. They should never paste commands from a website into Terminal, and they should download software only from verified sources.

Apple has added a warning for some risky pasted commands, but it may not catch every case. Anyone who wants to recognize these lures can review our ClickFix Terminal command tricks before running any command.

Moonlock sells a Mac security app, so its advice should be read with that in mind, but its tips on checking app privacy policies still apply.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Sell ICMacOS Remote Access Trojan for $699 a Week to Target Mac Users appeared first on Cyber Security News.