A Mac Stealer Now Rents for $699 a Week, and It Goes Straight for Developers' Cloud Keys

For most of the last two years, the Mac stealer problem has looked like a consumer problem with a corporate tail: crypto wallets, browser passwords, the odd hijacked Telegram account. The newest kit on the underground market is priced and built for something else. It is rented by the week, it goes looking for the files that let an engineer push code and run cloud infrastructure, and its latest version stops leaving after the theft. For organizations whose developers work on Macs, that turns one pasted command into a question about the whole build pipeline.

Malware Priced Like a SaaS Subscription

In an analysis published October 12, SOCRadar's Threat Research Unit describes ICMacOS, also called Icarus macOS, a stealer it identified in September 2026. The seller, a Russian-speaking, financially motivated actor using the handle GlowComa, has been active since January 2026 and promotes the kit on XSS, Exploit.in and Rehub, posting feature updates to a Telegram channel. Access costs $699 a week, $1,199 for two weeks or $1,699 a month. Customers who already use the seller's ICARUS ClickFix panel can take the monthly plan for $899.

That bundle explains the delivery. Victims land on a ClickFix page and are told to paste a command into Terminal. A Bash script pulls a dropper into /tmp, changes Terminal's preferences to hide window titles, and shows a spoofed System Preferences password prompt. The password is checked against the login Keychain, with up to five attempts, so the attacker only proceeds with a credential that works. The dropper then checks the processor architecture, fetches the matching Apple Silicon or Intel payload, closes Terminal and displays a fake error so the user assumes the install simply failed.

The pattern is not unique to one seller. In July, 9to5Mac summarized Netskope Threat Labs research on a campaign that lured users through fake macOS optimization utilities, fake GitHub repositories and localized IT support pages. Its first stage ran in memory and left no file on disk, it used the same fake System Preferences dialog to unlock the keychain, and it swapped 25 desktop crypto wallets for trojanized copies signed ad hoc so Gatekeeper raised no warning. Persistence came from a configuration file disguised as Apple's com.apple.accountsd that polled its server every minute.

The Real Target Is the Developer's Home Folder

ICMacOS takes what earlier stealers took: browser credentials and cookies, password manager and wallet data, Keychain contents, and Telegram, WhatsApp, Discord and iMessage sessions. SOCRadar singles out a different category as the supply chain risk. The malware reads SSH private keys and configs, AWS credentials, Kubernetes configs, GitHub CLI tokens and .git-credentials files, container, package manager and Terraform credentials, and runs a recursive search for .env files. Version 2 adds Outlook data, clipboard contents and shell history, which often hold the tokens and connection strings developers typed in by hand.

Those files rarely sit behind a second factor. A cloud access key, a kubeconfig or a package registry token works for whoever holds it, so the attacker does not need to phish anyone else to reach production. KELA's September analysis found version control systems made up 8.9% of the credentials stolen across its 2025 infostealer data, and counted macOS infections climbing from fewer than 1,000 in 2024 to more than 70,000 in 2025, as buyer demand for Mac stealers rose roughly tenfold between January 2022 and December 2025.

Version 2 also changes what happens after the theft. It writes a LaunchAgent named com.apple.systemupdater, chosen to resemble a legitimate Apple process, set to restart the binary if it stops and to rerun it every hour. It opens a WebSocket channel and executes whatever commands arrive through the system shell. A stolen key can be rotated. A Mac with a live remote shell will simply collect the replacement. SOCRadar also notes the malware shuts itself down if the system locale is Russian or the IP address geolocates to a CIS country.

The installed base gives sellers reason to keep investing. Jamf's Security 360 report, drawn from more than 150,000 devices, says Mac market share grew 16.4% year over year in 2025 and that trojans now make up more than half of all Mac malware. Macs are no longer the exception in an engineering department, and the tooling aimed at them has caught up.

What to Change on Developer Macs

Nothing in this chain relies on a software flaw. It relies on a user pasting a command, typing a password into a dialog that looks familiar, and holding long-lived secrets in plain files. Each of those is something IT can change.

• Get long-lived keys off the laptop. Replace static AWS keys, registry tokens and kubeconfig credentials with short-lived, brokered credentials issued through single sign-on, so a copied file expires before it can be sold.
• Treat any Mac that ran a pasted command as a credential event. Isolating the device is not enough. Rotate SSH keys, cloud credentials, Git tokens and anything in its .env files, then review cloud audit logs for use of the old ones.
• Lock down LaunchAgents through MDM. Alert on new items in ~/Library/LaunchAgents, and especially on anything using an Apple-style com.apple label that Apple did not ship. Both ICMacOS and the Netskope campaign hid behind that naming.
• Decide who actually needs Terminal. Restrict it for roles that do not, and for those that do, monitor for curl, osascript and Bash chains launched from a fresh Terminal window that write to /tmp.
• Watch for odd outbound sessions. A persistent WebSocket from a user process to an unfamiliar domain is unusual on a managed Mac. Feed published indicators, such as SOCRadar's list of domains and hashes, into DNS and proxy controls.
• Teach the password-prompt rule. macOS does not ask for a login password in a dialog that appears right after pasting a command from a web page. Make that one sentence part of developer onboarding.

At $1,699 a month, ICMacOS is cheap next to what one working cloud key or registry token can unlock. The organizations that come through this cycle will be the ones whose developer laptops hold nothing worth renting a stealer for.