TF-MAL-osx.icmacos
📛 Threat Title
Malware family: ICMacOS
Description
ThreatFox malware family `osx.icmacos`. Printable name: ICMacOS.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (8)
-
web:cyberpress.org
ICMacOS , also known as Icarus macOS, has evolved from a Mac information stealer into a persistent remote access trojan that gives attackers interactive shell access. SOCRadar researchers identified the malware in September 2026 and detailed its expanded capabilities in a report published on October 12.
-
web:cyberpress.org
ICMacOS , a malware family targeting Apple computers, has evolved from an information stealer into a persistent remote access trojan.
-
web:cybersecuritynews.com
ICMacOS evolves into a persistent Mac RAT, stealing credentials and crypto data while enabling remote commands and ongoing espionage.
-
web:cybersecuritynews.com
ICMacOS malware sells for $699 weekly, stealing Mac data while adding stealth, persistence, and remote command execution.
-
web:radar.offseq.com
ICMacOS (Icarus macOS) is a macOS malware -as-a-service stealer marketed since September 2026 by a Russian-speaking actor. It targets macOS Sierra through current versions on both Intel and Apple Silicon architectures. Initially a credential stealer, it evolved into a persistent remote access trojan (RAT) with WebSocket-based command-and-control. Infection uses social engineering with fake ...
-
web:socprime.com
Summary ICMacOS , also known as Icarus macOS, is a newly identified macOS Malware -as-a-Service (MaaS) that has evolved from a credential stealer into a persistent Remote Access Trojan (RAT). It targets high-value information including browser credentials, cryptocurrency wallets, and developer secrets such as SSH keys and cloud configurations.
-
web:socradar.io
ICMacOS illustrates the increasingly blurred boundary between commodity information stealers and remote access malware . Within weeks of its public launch, the project evolved from one-shot credential and wallet theft into a persistent WebSocket-controlled implant capable of interactive shell access.
-
web:www.cyware.com
What is GlowComa? GlowComa, a financially motivated, Russian-speaking threat actor, is behind ICMacOS—a macOS malware family that has evolved from simple password theft into a remote access trojan (RAT) that can survive reboots.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.