A stolen key can be rotated. A laptop with someone else’s shell in it will simply hand over the replacement.
That is the distinction SOCRadar drew in its analysis of ICMacOS, a macOS stealer rented on Russian-speaking forums at $699 a week. The seller, who goes by GlowComa, is a financially motivated operator visible since January.
What version two added
Delivery is familiar. A web page tells a visitor to paste a command into Terminal, the script blanks the window title, and a spoofed System Preferences dialog asks for the login password. That password is checked against the login Keychain with five attempts allowed, so the attacker proceeds only with a credential that works. The dropper then picks an Apple Silicon or Intel payload and flashes an error, leaving the victim to assume the install failed.
The upgrade opened a WebSocket channel and ran whatever commands arrived through the system shell. Persistence came from a LaunchAgent labelled com.apple.systemupdater.
The camouflage matches the target. The stealer searches for SSH private keys, AWS credentials, Kubernetes configs, GitHub CLI tokens, Terraform files and any .env it can reach, alongside browser vaults, wallets, Keychain entries and messenger sessions. Those developer files rarely carry a second factor.
The market moved first
AMOS is reported at $3,000 a month and MacSync at $1,000 to $1,500, so ICMacOS undercuts rivals while offering a live shell. KELA counted macOS stealer infections rising from under 1,000 to more than 70,000 in a year, and Jamf now puts trojans above half of all Mac malware.
The answer is not software. Move long-lived cloud keys to brokered credentials, alert on new LaunchAgents using Apple-style names, and treat any Mac where someone pasted a command as a credential incident.
