The Icarus macOS stealer has evolved from a smash-and-grab crypto and data stealer to malware with remote-access capabilities. This means the stealer can remain hidden, survive reboots, and send remote commands to your Mac once it breaches it.
The new Icarus, dubbed ICMacOS, sells for cheap on the dark web in the malware-as-a-service (MaaS) industry. Its campaigns appear active and operating at mid-volume.
Let’s dive in to learn more about this new stealer. Here’s what you need to know about what ICMacOS can do, how to spot an ICMacOS attack, and how to stay safe.
Keep your Mac safe from stealer malware
The “cheapest” macOS RAT/stealer has mixed dark web reviews but is coded for business
Recently, SOC Radar released a report on its investigation into the new ICMacOS. SOC Radar says ICMacOS is advertised and sold (with prices starting at $699 per week) by GlowComa, a financially motivated, Russian-speaking actor. GlowComa has been active since January 2026.
GlowComa offers ICMacOS on known Russian-language dark web forums, including XSS, Exploit.in, and Rehub, under the banner of the MADHASH crypto-draining affiliate group, says SOC Radar.
GlowComa also offers the Icarus ClickFix panel and a multi-chain crypto clipper along with the new RAT/stealer ICMacOS. Bundling is a strategy aimed at attracting more cybercriminal operators of the malware.
Offering weekly prices and monthly combo offers, such as $899 for existing users of the Icarus ClickFix panel, makes ICMacOS the most affordable macOS stealer sold on the dark web. By comparison, AMOS sells at $3,000/month, Banshee is $1,500–3,000/month, MacSync is $1,000–1,500/month, and the Poseidon stealer is $1,000. (These numbers are based on historical reported prices.)
The effectiveness of ICMasOS, however, appears to be somewhat questionable. According to SOC Radar, the dark web developer and distributor of this stealer, GlowComa, has a “mixed reputation” in the underground scene.
“The actor has been hit with multiple Exploit.in arbitration disputes regarding poor payload conversion rates, fast detection times, and unfulfilled service guarantees, prompting forum moderators to repeatedly demand escalating security deposits,” SOC Radar says.
Combining stealer capabilities with RATs is commonplace in the macOS threat landscape. Virtually all stealers have backdoors and remote command functions. Distributing malware using ClickFix fake pages is also common.
ICMasOS can breach new and old Macs, Apple Intel and Apple Silicon alike (x86_64 and ARM64). It is coded to steal core assets, including browser credentials, password manager databases, cryptocurrency wallets, developer secrets, messaging application data, and local files.
Additionally, with this update, it now has full RAT functionality, leveraging WebSockets for Command-and-Control (C2) and LaunchAgents for persistence.
What’s up with all the macOS trojans, backdoors, and RATs?
Recent macOS stealer cybersecurity reports have begun to take a closer look at stealers. They have started decoupling the payloads that come with or before the stealer itself. Consequently, a lot of reports speak of the components of multi-stage stealer malware that include trojans, backdoors, and RATs. However, the main purpose of the cyberattack continues to be financially driven.
Most stealers today are trojans (or ClickFix spread). Like ICMacOS, they will prompt you for your password once you run a malicious command or try to install a malicious app on your Mac. The password is used later, after a second stager is fetched to install more malware on your Mac without raising any security flags.
Next, third-stage payloads drop into your Mac. These include backdoors or RATs that establish a communication channel between your Mac and the attackers’ controlled servers and persistence (usually hiding as LaunchAgents).
After all this comes the stealer, a distinct malware and payload, which is coded to find and extract your data. This data will be used to breach your accounts, open cloned browser and account sessions, and steal your credentials.
When a stealer has a RAT, it gains the capability of surviving a reboot or restart of your Mac. It can remain hidden, checking out what you are doing, changing configurations, escalating privileges, moving laterally through networks, and grabbing more data or sending remote commands that install more malware on your Mac.
In Q3 Mac malware reports, trojans and infostealers are highlighted as leading types of malware. It’s not uncommon to hear about new macOS trojans/stealers. It’s also not unheard of to learn about new macOS stealers that now have backdoors, as MacSync did in 2025. In the case of ICmacOS, it evolved to incorporate a RAT. No matter the scenario, when you hear stories like this, it’s worth remembering that the core of the attack, the purpose, is the same: to install a stealer.
Having said that, why would macOS stealer cybercriminals want to stay inside your computer after they have already taken your data and crypto data?
Here’s why macOS stealers aim to establish persistence
Reports show that malware operators need to piece together certain data to actually unlock your accounts. Having persistence can make that job easier.
Different malware developers have taken various approaches to the problem of “piecing together the stolen information.” For example, the new Amnesia stealer can open in real time a cloned browser session on breached Macs with no password, no 2FA request, and full access to your browser and live account sessions. This includes emails, messaging, crypto wallets, and more.
Additionally, experts explain that a stealer’s persistence is all about enterprise access.
“RATs give attackers more capabilities than simply stealing passwords and/or files,” Noam Birnbaum, Founder and CEO of San Francisco-based Ignition, told us.
“With some RATs, attackers may also be able to monitor user activity, and/or access other information on the device and do other things to the device,” says Birnbaum.
Kevin M. Coles, Founder and Principal of the Arizona-based Coles Technical Group, told us that the obsession with RATs is because Macs are where the valuable people are.
“Developers, founders and executives disproportionately use them, and those machines hold SSH keys, cloud logins, and crypto wallets,” says Coles.
For years, Mac users were also the least defended, due to the assumption Macs don’t get malware, says Coles. “Attackers follow both the money and the gap, and on macOS right now, those point to the same place,” Coles says.
“The bigger concern is supply chain risk,” Umut Bayram, Associate Security Research Engineer at Picus Security, told us.
“ICMacOS deliberately hunts for developer secrets such as SSH keys, cloud credentials and Kubernetes configurations,” says Bayram.
One compromised laptop can become a gateway into a company’s code, infrastructure, and customers, Bayram explains. “That persistence is the appeal. Instead of a single snapshot, criminals can keep harvesting passwords, session tokens, and crypto wallets for as long as they stay hidden.”
How to stay safe from ICMacOS and other RATs + stealers
As Bayram says, within weeks of launch, ICmacOS evolved from a one-time data thief into a persistent remote access trojan that gives attackers live control of the machine. So, how can you stay safe? The following are some tips and suggestions.
Be mindful of ClickFix Terminal commands and fake sites
This stealer, like almost all others, is breaching devices using ClickFix techniques that are hosted on fake websites. Users usually land on these websites via links, malvertising (fake ads), or SEO poisoning. In other words, you search for something online, and you get a non-paid, organic, malicious top-of-page result.
Cybercriminals use these sites to try to convince you to copy and paste a malicious script into your Terminal. Or they may use a more automated ClickFix variation. Another option is to automatically load your Script Editor and ask you to hit play. Knowing how this works should help you stay clear of ClickFix sites.
Apple recently added a ClickFix warning feature, which blocks or alerts you if you’re attempting to paste malicious commands into your Terminal. However, don’t expect it to flag every cyberattack. Do not run commands on your Terminal unless you know they are 100% safe.
Only download files you have checked and rechecked for safety and privacy
Take some time to make sure that whatever you are downloading on your Mac comes from the actual source. Being certain that the download is safe and legit can go a long way. This includes checking apps and their privacy policies.
Get Moonlock. It will block old and new macOS malware and threats.
With new macOS malware constantly emerging and evolving, security tools have a hard time keeping up. The Moonlock antivirus app, built to offer added layers of Mac defense, is constantly updated to deal with old and new threats alike.
Once installed, Moonlock will run Real-Time Protection in the background. This silently checks everything you interact with, including emails, files you download, and terminal commands, for malware signatures and suspicious behavior. Additionally, the Malware Scanner, customizable for speed and depth, will check deep inside your Mac. It can search for anything that should not be there, including backdoor and RAT persistence agents or other dropped files.
Moonlock also ships with a built-in VPN, a Scam Detector to flag scams and phishing, System Protection to level up your Mac settings, and a Security Advisor to help you build safe digital habits.
You can check out and test-drive Moonlock for free for 7 days.
Final thoughts
According to Coles from Coles Technical Group, the shift from stealer to remote access trojan is the real story here. Version 1 grabbed what it could and left. But Version 2 sticks around. And once an attacker has persistent access to a Mac, the stolen passwords are just the start. They can come back for whatever gets saved next: new logins, wallet keys, or the cloud credentials a developer adds tomorrow.
“And it’s sold as a service, which means the people using it don’t need to be skilled,” Coles says. “They just need to rent it.”
As of today, ICMacOS is the “cheapest” macOS stealer in town. And while it has mixed reviews in the underground world, it is the most accessible out there and comes with all the features other stealers have.
This is an independent publication, and it has not been authorized, sponsored, or otherwise approved by Apple Inc. Mac and macOS are trademarks of Apple Inc.
