A rented stealer that grew claws
A malware kit sold by subscription has grown into something more durable than the credential thief it started as. SOCRadar’s Threat Research Unit detailed the family on October 12: a tool that began as a standard infostealer and, within weeks, shipped a second version that keeps a foothold and takes orders.
The operator, tracked as GlowComa, has pushed the kit since early September on forums including XSS, Exploit.in and Rehub. Pricing runs $699 a week or $1,699 a month.
How it gets in
Delivery leans on the familiar paste-and-run trick. A page feeds the victim a command that pulls a Bash script from a lookalike domain and runs it. The script quiets Terminal, stripping window titles and process names, then spawns a fake System Preferences prompt to harvest the login password, validated against the Keychain before proceeding.
A follow-up request reports the host’s chip architecture and serves the matching Mach-O payload. Compiled in Go, the versions diverge: the first harvests data and exits, while the second installs a LaunchAgent named com.apple.systemupdater to blend into process listings, survives reboots and reconnects hourly.
What it takes
Browsers across Chromium, Safari and Gecko engines yield saved logins, cookies and history. The stealer carries a Go library that decrypts the login Keychain offline using the captured password. Messages from iMessage and WhatsApp, tokens from Discord and Telegram, Steam accounts, notes, call logs and clipboard contents are all in scope.
Developer machines rank high: SSH keys, Git credentials, cloud CLI tokens and shell histories, plus password managers including 1Password and Bitwarden. Version two adds a WebSocket channel to its server, turning theft into live remote control.
The defense has not moved: treat unsolicited install instructions as hostile, and never paste commands from unfamiliar pages into Terminal.
