Malwarehigh
ICMacOS Mac malware sold for $699 a week with remote commands
Original title: Hackers Sell ICMacOS Remote Access Trojan for $699 a Week to Target Mac Users
AI summary · x-ai/grok-4.7Summaries by Vani AI
Version 2 adds a WebSocket shell and LaunchAgent persistence while still stealing developer and wallet secrets.
SOCRadar’s Threat Research Unit identified ICMacOS, also called Icarus macOS, in September 2026 and reported on October 12. Seller GlowComa offers it for $699 a week on Russian-speaking forums under the MADHASH banner. Infection uses fake pages that prompt victims to paste a Terminal command, then a fake password prompt. Version 2 can run operator commands through /bin/sh and persist with a LaunchAgent.
Unconfirmed: Listed competitor prices are historical reported figures, and the seller has disputed underground reviews.
Key facts
- Moonlock called it the cheapest macOS stealer, citing higher prices for AMOS and Banshee.
- The dropper selects Apple Silicon or Intel payloads and checks the login Keychain.
- It stops on Russian and other CIS-language or location matches.
- Targets include SSH keys, AWS and Kubernetes settings, Git credentials, and .env files.
- C2 domains include escapeai.live and mikoblico.xyz.
Security assessment · AI, from the article
Impact: Remote shell plus theft of credentials, wallets, and developer secrets
What to do
- 1.Do not paste website commands into Terminal.
- 2.Download Mac software only from verified sources.
- 3.Hunt for LaunchAgent com.apple.systemupdater.plist and the published hashes.
- Vendors
- Apple
- Products
- macOS
- Malware
- ICMacOSIcarus macOS
- Organizations
- SOCRadarMoonlock Lab
- Countries
- Russia
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | escapeai.live | rs of compromise (IoCs):- Type Indicator Description Domain escapeai[.]live ICMacOS login, payload delivery, and C2 Domain mikoblico[ |
| domain | mikoblico.xyz | apeai[.]live ICMacOS login, payload delivery, and C2 Domain mikoblico[.]xyz ICMacOS login IP Address 85.137.253[.]61 ICMacOS login IP |
| ipv4 | 45.13.186.247 | S login IP Address 85.137.253[.]61 ICMacOS login IP Address 45.13.186[.]247 ICMacOS login URL hxxps[://]escapeai[.]live/api/build_con |
| ipv4 | 85.137.253.61 | ery, and C2 Domain mikoblico[.]xyz ICMacOS login IP Address 85.137.253[.]61 ICMacOS login IP Address 45.13.186[.]247 ICMacOS login UR |
| sha256 | 3d4f70172c8f31813e7b37fc1a49bce193663e33c4eb65952bb5aec9d7176826 | 849edf86c48767a1a13f32f4a6a631a65ae2 ICMacOS dropper SHA256 3d4f70172c8f31813e7b37fc1a49bce193663e33c4eb65952bb5aec9d7176826 ICMacOS dropper SHA256 8b7606bdccdd6ff691db875283fdf5b6b658 |
| sha256 | 5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8 | md-private-helper.zip Collected data archive example SHA256 5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8 ICMacOS dropper SHA256 8cc449e7e240894e77187f6faff415bc8b9f |
| sha256 | 62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17 | 15bc8b9f2f9da73f60eef1f7605debd9144a ICMacOS dropper SHA256 62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17 ICMacOS dropper SHA256 857236d1902f4604acdf27519c0310064d21 |
| sha256 | 6917505bbdc8efa01ea1a0298eae62a93a57a8c98d3712a69d822dca4a667f05 | 10064d21f8a82af3b95b1e4f02fef581b1d0 ICMacOS dropper SHA256 6917505bbdc8efa01ea1a0298eae62a93a57a8c98d3712a69d822dca4a667f05 ICMacOS dropper SHA256 dca852b53c259641e1782bd9122c50071306 |
| sha256 | 857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0 | c8ff198dc4df3fd2e1167f537096e0b4dd17 ICMacOS dropper SHA256 857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0 ICMacOS dropper SHA256 6917505bbdc8efa01ea1a0298eae62a93a57 |
| sha256 | 8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69 | 3fb9122907214afac3908b587f4 ICMacOS Mach-O Version 2 SHA256 8b4303a065e18e80050ef22031ec60b1a4e84f958d9e56cc5cc34cd29d988d69 ICMacOS Python payload Note: IP addresses and domains are i |
| sha256 | 8b7606bdccdd6ff691db875283fdf5b6b658dd8d4d141b44e07f8f2583ff5604 | bce193663e33c4eb65952bb5aec9d7176826 ICMacOS dropper SHA256 8b7606bdccdd6ff691db875283fdf5b6b658dd8d4d141b44e07f8f2583ff5604 ICMacOS dropper SHA256 bc8d70f000e73c0c7a69a2676805190e7109 |
| sha256 | 8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a | ba16cf28e290e9439d04101f0a8191f929d8 ICMacOS dropper SHA256 8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a ICMacOS dropper SHA256 62e435102e1e1de74537f174ede7c8ff198d |
| sha256 | a9b21ac0112855b835b5e5850ef167471eff7305d42b3a8104c1961b257a444d | ab59df3e34c5a74d2cb7f13a7e4 ICMacOS Mach-O Version 1 SHA256 a9b21ac0112855b835b5e5850ef167471eff7305d42b3a8104c1961b257a444d ICMacOS Mach-O Version 1 SHA256 c8136413ad38a1028050f5d508e |
| sha256 | bc8d70f000e73c0c7a69a2676805190e7109cab59df3e34c5a74d2cb7f13a7e4 | f5b6b658dd8d4d141b44e07f8f2583ff5604 ICMacOS dropper SHA256 bc8d70f000e73c0c7a69a2676805190e7109cab59df3e34c5a74d2cb7f13a7e4 ICMacOS Mach-O Version 1 SHA256 a9b21ac0112855b835b5e5850ef |
| sha256 | c8136413ad38a1028050f5d508e25267b518c5fdeac80b6442103d1009d8924c | 305d42b3a8104c1961b257a444d ICMacOS Mach-O Version 1 SHA256 c8136413ad38a1028050f5d508e25267b518c5fdeac80b6442103d1009d8924c ICMacOS Mach-O Version 1 SHA256 e52855d447d152bb698e565f361 |
| sha256 | d9df05a3fb68d302ecf134a1214b609c6ec0a3fb9122907214afac3908b587f4 | 183ab09bf3cbea89765a2b5ff31 ICMacOS Mach-O Version 2 SHA256 d9df05a3fb68d302ecf134a1214b609c6ec0a3fb9122907214afac3908b587f4 ICMacOS Mach-O Version 2 SHA256 8b4303a065e18e80050ef22031e |
| sha256 | dca852b53c259641e1782bd9122c5007130614a7a8fd17102400acb4f50f6e94 | 62a93a57a8c98d3712a69d822dca4a667f05 ICMacOS dropper SHA256 dca852b53c259641e1782bd9122c5007130614a7a8fd17102400acb4f50f6e94 ICMacOS dropper SHA256 e7e8ac14aaee970c6d00c6cbb398decc56df |
| sha256 | e52855d447d152bb698e565f361161cdc8946183ab09bf3cbea89765a2b5ff31 | 5fdeac80b6442103d1009d8924c ICMacOS Mach-O Version 1 SHA256 e52855d447d152bb698e565f361161cdc8946183ab09bf3cbea89765a2b5ff31 ICMacOS Mach-O Version 2 SHA256 d9df05a3fb68d302ecf134a1214 |
| sha256 | e7e8ac14aaee970c6d00c6cbb398decc56dfc128974c01bfc8e7acd13a18576e | 5007130614a7a8fd17102400acb4f50f6e94 ICMacOS dropper SHA256 e7e8ac14aaee970c6d00c6cbb398decc56dfc128974c01bfc8e7acd13a18576e ICMacOS dropper SHA256 ec37acd3bd15f50eee2941d5644ca0ee738b |
| sha256 | ec37acd3bd15f50eee2941d5644ca0ee738b36ce4a39e9e08058e35ebc7961fc | decc56dfc128974c01bfc8e7acd13a18576e ICMacOS dropper SHA256 ec37acd3bd15f50eee2941d5644ca0ee738b36ce4a39e9e08058e35ebc7961fc ICMacOS dropper SHA256 fcf9de13ecc70b4fda3998ed7a93849edf86 |
| sha256 | fcf9de13ecc70b4fda3998ed7a93849edf86c48767a1a13f32f4a6a631a65ae2 | a0ee738b36ce4a39e9e08058e35ebc7961fc ICMacOS dropper SHA256 fcf9de13ecc70b4fda3998ed7a93849edf86c48767a1a13f32f4a6a631a65ae2 ICMacOS dropper SHA256 3d4f70172c8f31813e7b37fc1a49bce19366 |
From the original article
4 min read at cybersecuritynews.com
Cybercriminals are selling a Mac malware kit that can do far more than steal passwords. The tool, called ICMacOS or Icarus macOS, is offered for $699 a week on Russian-speaking dark web forums. It began as a basic data stealer, but its newer version can stay hidden on a Mac, survive restarts, and run commands […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.