ICMacOS (Icarus macOS) is a macOS malware-as-a-service stealer marketed since September 2026 by a Russian-speaking actor. It targets macOS Sierra through current versions on both Intel and Apple Silicon architectures. Initially a credential stealer, it evolved into a persistent remote access trojan (RAT) with WebSocket-based command-and-control. Infection uses social engineering with fake system dialogs to harvest administrator passwords and deploy the payload. Version 1 steals browser credentials, cryptocurrency wallets, developer secrets, messaging data, and password managers. Version 2 adds RAT features with persistence and interactive shell access, expanding data theft to Steam accounts, Outlook data, and more password managers.