Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

ICMacOS stealer gains reboot-surviving RAT features, sold at $699 a week

2 sources · 2 articlesFirst reported Updated ()1
What's new

October 27: Cyber Security News adds C2 domains, CIS-language and location checks, targeted developer secrets, and Moonlock’s price comparison.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

GlowComa is selling ICMacOS version 2, a macOS stealer with a WebSocket shell and LaunchAgent persistence, for $699 a week.

SOCRadar’s Threat Research Unit identified ICMacOS, also called Icarus macOS, in September 2026 and reported it on October 12. Seller GlowComa, described as a financially motivated Russian-speaking actor, markets version 2 for $699 a week on XSS, Exploit.in, and Rehub under the MADHASH crypto-draining banner. Infection uses ClickFix-style pages that prompt victims to paste a Terminal command, then a fake password dialog. Version 2 still steals developer and wallet secrets and adds WebSocket command-and-control that can run operator commands through /bin/sh, plus a LaunchAgent named com.apple.systemupdater that relaunches after reboots. Moonlock called it the cheapest macOS stealer, citing higher prices for AMOS and Banshee.

Key facts
  • Version 2 uses WebSockets and can execute commands through /bin/sh.
  • Persistence uses com.apple.systemupdater with hourly KeepAlive and survives reboots.
  • The dropper selects Apple Silicon or Intel payloads and checks the login Keychain.
  • It stops on Russian and other CIS-language or location matches.
  • Targets include SSH keys, AWS and Kubernetes settings, Git credentials, and .env files.
  • C2 domains include escapeai.live and mikoblico.xyz, according to Cyber Security News.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 12, 2026SOCRadar reports ICMacOS after identifying it in September. · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersLaunchAgent name, hourly KeepAlive, and forums XSS, Exploit.in, and Rehub.
  • Cyber Security NewsSeptember identification, Moonlock pricing, CIS checks, targets, and C2 domains.
Vendors
Apple
Products
macOS
Threat actors
GlowComaMADHASH
Malware
ICMacOSIcarus macOS
Victims
Mac users
Organizations
SOCRadarMoonlockMoonlock Lab
Countries
Russia

Coverage

oldest first · one row per article · UTC
  1. · 4d ago GBHackersFirst report

    ICMacOS macOS stealer gains RAT capabilities with reboot persistence

    ICMacOS now includes WebSocket remote commands and LaunchAgent persistence that survives reboots.

  2. · 3d ago Cyber Security News

    ICMacOS Mac malware sold for $699 a week with remote commands

    Version 2 adds a WebSocket shell and LaunchAgent persistence while still stealing developer and wallet secrets.