ICMacOS: Evolution of MaaS Infostealer to RAT

In September 2026, the SOCRadar Threat Research Unit identified ICMacOS (also known as Icarus macOS), a new macOS-based Malware-as-a-Service (MaaS) promoted by a Russian-speaking actor known as GlowComa. Operated under the MADHASH crypto-draining group, the malware explicitly targets global victims while enforcing a geo-lock to exclude Russia and Commonwealth of Independent States (CIS) countries. The threat is distributed via social engineering campaigns, specifically using 'ClickFix' panels to trick users into executing terminal commands.

Technically, ICMacOS has rapidly evolved through two major versions. Version 1 functions as a modular infostealer targeting browser credentials, cryptocurrency wallets, and developer secrets (SSH keys, AWS/K8s configs). Version 2 introduces sophisticated persistence via LaunchAgents and full Remote Access Trojan (RAT) capabilities using WebSockets for real-time interactive shell access. This evolution demonstrates a high level of development activity and a pivot toward long-term environment exploitation.

The expansion of Apple's enterprise footprint makes this threat particularly significant for software developers and cloud engineers. The malware's focus on harvesting environment files (.env), cloud provider credentials, and source control tokens creates substantial risk for supply chain attacks and lateral movement into broader enterprise cloud infrastructure.