Threat Intelligence

New Mac Infostealer ICMacOS Is Being Sold to Cybercriminals on Underground Forums

SOCRadar · 12 Oct 2026

Key Takeaway Do not assume Macs are safe from malware: apply the same endpoint protection, software controls and staff awareness training to Mac devices as you do to Windows ones.

Mac computers are now a common sight in business, and attackers have noticed. The source notes that roughly one in three software developers in the United States works on macOS, and that threat data shows a sharp rise in attacks aimed at Macs, including a surge in infostealer malware. Much of this is driven by Malware-as-a-Service (MaaS), where criminals rent ready-made tools instead of building their own. Stealers such as AMOS, MacSync and Cthulhu have spread this way.

SOCRadar's Threat Research Unit has identified a new addition called ICMacOS (Icarus macOS). Since early September 2026, it has been promoted on Russian-speaking forums including XSS, Exploit.in and Rehub by an actor known as GlowComa, who has been active since January 2026 and is financially motivated. GlowComa operates under the MADHASH crypto-draining affiliate group and sells ICMacOS as part of a wider "ICARUS" suite. The suite also includes a ClickFix social engineering panel and a multi-chain crypto clipper, and the tools are often bundled to attract affiliates. The actor targets victims worldwide but excludes Russia and CIS countries.

GlowComa's standing in the underground is mixed. The actor has faced several arbitration disputes on Exploit.in over poor payload conversion rates, fast detection times and unfulfilled guarantees, and moderators have repeatedly demanded larger security deposits. The source excerpt does not cover the malware's technical behaviour in detail.

macOS infostealer malware-as-a-service dark web

Summarised by CISO AI from SOCRadar, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.