Three concurrent OTX pulses published 2026-10-27 reveal a cross-platform threat landscape spanning macOS Malware-as-a-Service, e-commerce supply-chain skimming, and DNS infrastructure abuse. Enterprise defenders face simultaneous pressure on endpoint, web application, and DNS layers.
Threat Summary
This intelligence set covers three unrelated but operationally significant campaigns:
-
ICMacOS (Icarus macOS) — a newly identified macOS Malware-as-a-Service marketed since September 2026 by the Russian-speaking actor GlowComa on underground forums. Initially a credential stealer, ICMacOS has rapidly evolved into a persistent remote access trojan targeting macOS Sierra through current releases on both Intel and Apple Silicon. The pulse associates it with the broader macOS stealer ecosystem (AMOS, MacSync, Cthulhu), suggesting shared codebases, builder kits, or reseller relationships typical of the Russian-language MaaS underground.
-
Convertr / Plausible Supply-Chain Skimming — a Brazilian Magecart group active since 2024 compromised the Plausible analytics script served from
analytics.convertr.app.br, injecting a card skimmer into every Convertr checkout beginning 2026-10-24. Stolen data includes full card PANs, CVV, expiry, cardholder names, and Brazilian CPF taxpayer numbers — a combination enabling both card fraud and identity theft. The pulse references CVE-2026-8467, indicating a platform vulnerability was leveraged for the injection. -
Hidden Hawk Domain Shadowing — attackers gained unauthorized access to DNS administration for educational and government domains in Bangladesh, India, and Mexico, creating CNAME records beneath legitimate institutional namespaces (
*.edu.bd,*.edu.mx) to host illegal gambling content and harvest borrowed domain reputation for SEO. While financially motivated rather than espionage, the technique demonstrates trivial compromise of institutional DNS control planes — the same access vector used for phishing, malware delivery, and C2 hosting in APT operations.
Collectively, these pulses show adversaries monetizing trusted execution environments: trusted operating systems (macOS), trusted third-party scripts (analytics), and trusted DNS namespaces (institutional domains).
Threat Actor / Malware Profile
ICMacOS / Icarus macOS (Actor: GlowComa)
- Distribution: Sold as MaaS on Russian-language underground forums; typical delivery vectors for this ecosystem include malicious DMG installers, cracked software bundles, fake browser updates, and spearphishing with trojanized productivity apps.
- Payload behavior: Credential and session theft (browser cookies, keychain items, crypto wallet data, autofill stores), now extended with full RAT functionality — remote command execution, file exfiltration, and interactive operator access.
- C2 communication: Outbound HTTPS to actor-controlled infrastructure. Observed C2/exfil indicators include
escapeai.live,mikoblico.xyz, and IPs85.137.253.61and45.13.186.247. Expect domain-fronting or fast-flux rotation given the MaaS customer base. - Persistence: Evolved beyond smash-and-grab stealer behavior — expect LaunchAgents/LaunchDaemons plist installation (
~/Library/LaunchAgents), login items, or dylib hijacking for durable access. - Anti-analysis: Apple Silicon/Intel universal binaries complicate static triage; macOS stealers in this family commonly check for VM artifacts, use AppleScript (osascript) for social-engineering password prompts, and strip symbols.
Brazilian Magecart Group (Convertr Supply Chain)
- Distribution: Supply-chain injection into a legitimately served third-party analytics script — every checkout page load delivered the skimmer with no endpoint compromise required.
- Payload behavior: DOM-level form-jacking capturing PAN, CVV, expiry, cardholder name, and CPF in real time; exfiltration via WebSocket endpoints (
wss-style traffic to1x0.is/ws) and decoy/bulletproof domains (ecomscan.com,antiddos-protection.net,deepveindrilling.com). - Persistence: Lives entirely in the compromised script — removal requires fixing the upstream injection point, not endpoint remediation.
Hidden Hawk (Domain Shadowing)
- Technique: Compromised DNS registrar/hosting credentials for institutional domains; created unauthorized CNAME delegations pointing subdomains of
escuelanormallarrainzar.edu.mx,dhabalsatihs.edu.bd,maishadihighschool.edu.bd,raahs.edu.bd,saaacademy.edu.bd, andsanguhs.edu.bdtoward actor infrastructure (hinkale.me,imghaxor.io). - Objective: Parasite SEO for illegal gambling — but the identical access pattern supports phishing kit hosting and malware staging under inherited domain trust.
IOC Analysis
The pulse set contains four operational indicator classes:
- IPv4 (C2/exfil):
85.137.253.61,45.13.186.247— block at egress firewall, proxy, and EDR network layers. Add to threat intel platforms with a 90-day decay. - Domains: Split by campaign. ICMacOS C2 (
escapeai.live,mikoblico.xyz); Magecart exfil/infra (ecomscan.com,antiddos-protection.net,deepveindrilling.com); shadowing tooling (hinkale.me,imghaxor.io) and victim institutional domains (monitor-only — these are victims, do not block wholesale; alert on unexpected subdomains instead). - FileHash-SHA256: Seven hashes across the pulses (ICMacOS samples and skimmer artifacts). Push to EDR blocklists and retro-hunt file creation events.
- URLs:
http://1x0.is/ws,https://1x0.is/ws/— WebSocket exfil endpoints; alert on any TLS/WS session to1x0.is. - CVE: CVE-2026-8467 — track against Convertr/Plausible deployments in your asset inventory; treat any exposed instance as compromised until proven otherwise.
Operationalization: Ingest into your TIP (MISP/OpenCTI) tagged by pulse ID; pipe network IOCs to DNS firewall (RPZ) and proxy blocklists; hashes to EDR; domains to SIEM watchlists. Tooling for decoding: dnstwist/dig for shadowed subdomain enumeration, VirusTotal/OTX DirectConnect for hash enrichment, and headless-browser sandboxing (e.g., Sansec-style checkout emulation) for skimmer script extraction.
Detection Engineering
---
title: ICMacOS macOS Stealer/RAT LaunchAgent Persistence
id: 8f3a1c2e-7b4d-4e9a-a1c5-icmacos00001
status: experimental
description: Detects LaunchAgent/LaunchDaemon plist creation consistent with ICMacOS (Icarus macOS) persistent RAT behavior observed in OTX pulse (GlowComa MaaS)
author: Security Arsenal Threat Intel
references:
- https://socradar.io/blog/icmacos-infostealer-rat
date: 2026/10/27
logsource:
product: macos
category: file_event
detection:
selection_path:
TargetFilename|contains:
- '/Library/LaunchAgents/'
- '/Library/LaunchDaemons/'
- '~/Library/LaunchAgents/'
selection_ext:
TargetFilename|endswith: '.plist'
filter_known_good:
Image|contains:
- '/System/Library/'
- '/Applications/Google Chrome.app'
- '/Library/Microsoft/'
condition: selection_path and selection_ext and not filter_known_good
level: high
tags:
- attack.persistence
- attack.t1543.001
- attack.t1543.004
---
title: ICMacOS C2 Network Communication to Known Infrastructure
id: 9d2b4f1a-3c8e-4b7d-b2e6-icmacos00002
status: experimental
description: Detects outbound connections to ICMacOS/Icarus macOS C2 domains and IPs from OTX pulse 2026-10-27
author: Security Arsenal Threat Intel
date: 2026/10/27
logsource:
category: network_connection
detection:
selection_domain:
DestinationHostname|contains:
- 'escapeai.live'
- 'mikoblico.xyz'
selection_ip:
DestinationIp:
- '85.137.253.61'
- '45.13.186.247'
condition: selection_domain or selection_ip
level: critical
tags:
- attack.command_and_control
- attack.t1071.001
---
title: Magecart Skimmer WebSocket Exfiltration to 1x0.is
id: 7e1c3a9d-5f2b-4a8c-c3d7-magecart0003
status: experimental
description: Detects network connections to Magecart exfiltration infrastructure used in the Convertr/Plausible supply-chain skimming campaign (CVE-2026-8467)
author: Security Arsenal Threat Intel
references:
- https://sansec.io/research/convertr-plausible-supply-chain-attack
date: 2026/10/27
logsource:
category: network_connection
detection:
selection:
DestinationHostname|contains:
- '1x0.is'
- 'ecomscan.com'
- 'antiddos-protection.net'
- 'deepveindrilling.com'
condition: selection
level: critical
tags:
- attack.exfiltration
- attack.t1041
- attack.t1189
// Hunt: ICMacOS C2 + Magecart exfil + domain-shadowing resolution — OTX 2026-10-27
let C2_IPs = dynamic(["85.137.253.61", "45.13.186.247"]);
let BadDomains = dynamic(["escapeai.live", "mikoblico.xyz", "1x0.is", "ecomscan.com",
"antiddos-protection.net", "deepveindrilling.com", "hinkale.me", "imghaxor.io"]);
let ShadowedEdu = dynamic(["escuelanormallarrainzar.edu.mx", "dhabalsatihs.edu.bd",
"maishadihighschool.edu.bd", "raahs.edu.bd", "saaacademy.edu.bd", "sanguhs.edu.bd"]);
union isfuzzy=true
(DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteIP in (C2_IPs) or RemoteUrl has_any (BadDomains)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType),
(DeviceEvents
| where Timestamp > ago(14d)
| where ActionType == "DnsQueryResponse" or AdditionalFields has_any (BadDomains)
| extend Query = tostring(parse_json(AdditionalFields).DnsQueryString)
| where Query has_any (ShadowedEdu) // unexpected subdomain lookups under victim institutional domains
| project Timestamp, DeviceName, Query, ActionType),
(DeviceFileEvents
| where Timestamp > ago(14d)
| where SHA256 in ("5dfb0c01ac5c075e23ec37873b30ba16cf28e290e9439d04101f0a8191f929d8",
"8cc449e7e240894e77187f6faff415bc8b9f2f9da73f60eef1f7605debd9144a",
"62e435102e1e1de74537f174ede7c8ff198dc4df3fd2e1167f537096e0b4dd17",
"857236d1902f4604acdf27519c0310064d21f8a82af3b95b1e4f02fef581b1d0",
"ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256)
| order by Timestamp desc
#!/usr/bin/env bash
# ICMacOS RAT endpoint hunt — macOS (run via MDM/remote shell across fleet)
# Checks persistence artifacts, suspicious processes, and C2 connectivity
set -u
echo "=== ICMacOS Hunt — $(hostname) — $(date -u) ==="
echo "[1] LaunchAgent/Daemon plists modified in last 30 days (non-Apple):"
for d in "$HOME/Library/LaunchAgents" /Library/LaunchAgents /Library/LaunchDaemons; do
[ -d "$d" ] && find "$d" -name "*.plist" -mtime -30 -exec sh -c \
'grep -L "apple\|google\|microsoft" "$1" >/dev/null 2>&1 && echo " SUSPECT: $1"' _ {} \;
done
echo "[2] Unsigned/recently-added login items:"
osascript -e 'tell application "System Events" to get the name of every login item' 2>/dev/null | tr ',' '\n'
echo "[3] Active connections to known ICMacOS C2:"
lsof -i -nP 2>/dev/null | grep -E "85\.137\.253\.61|45\.13\.186\.247|escapeai\.live|mikoblico\.xyz" \
&& echo " !!! C2 CONNECTION FOUND — ISOLATE HOST" || echo " none"
echo "[4] Recent DNS lookups for C2 domains (cached):"
log show --predicate 'subsystem == "com.apple.network"' --last 24h --style compact 2>/dev/null \
| grep -iE "escapeai\.live|mikoblico\.xyz" | head -20 || echo " (log access may require sudo)"
echo "[5] Known ICMacOS sample hashes in common staging dirs:"
for f in /tmp/* /var/tmp/* "$HOME/Downloads"/*.dmg "$HOME/Downloads"/*.app; do
[ -f "$f" ] && shasum -a 256 "$f" 2>/dev/null
done | grep -iE "5dfb0c01ac5c075e|8cc449e7e240894e|62e435102e1e1de7|857236d1902f4604" \
&& echo " !!! KNOWN MALICIOUS SAMPLE FOUND" || echo " none"
echo "=== Hunt complete ==="
Response Priorities
Immediate (0–4h):
- Block
85.137.253.61,45.13.186.247,escapeai.live,mikoblico.xyz,1x0.is,ecomscan.com,antiddos-protection.net,deepveindrilling.comat proxy, DNS (RPZ), and egress firewall. Push all seven SHA256 hashes to EDR blocklists. - Run the KQL query fleet-wide for the last 14 days; isolate any host with C2 hits.
- If you operate e-commerce on Convertr or load Plausible analytics from
analytics.convertr.app.br: pull the script immediately, audit for injected skimmer code, and treat all transactions since 2026-10-24 as exposed. - Execute the macOS hunt script across the Apple fleet via MDM.
24 hours:
- ICMacOS steals credentials and session tokens — for any host with confirmed execution, force full credential rotation (IdP, email, VPN, banking, crypto wallets) and revoke all active sessions/OAuth tokens. Assume keychain compromise.
- Magecart victims: notify acquiring banks and trigger card reissuance workflows; CPF theft requires LGPD breach notification assessment for Brazilian data subjects.
- Audit your own DNS zones for unauthorized CNAME/NS records (domain shadowing check) — enumerate all subdomains on institutional domains you control and diff against known-good.
1 week:
- Enforce macOS hardening: Gatekeeper/Notarization enforcement, MDM restrictions on unsigned LaunchAgents, and EDR coverage on Apple Silicon (often a blind spot).
- Deploy Subresource Integrity (SRI) and Content Security Policy on all checkout/payment pages; implement client-side script integrity monitoring to catch third-party tag tampering (the Convertr kill vector).
- Lock down DNS management: MFA on registrar accounts, registry lock where available, and continuous monitoring (e.g., DNS change alerting) for institutional domains — Hidden Hawk demonstrates registrar compromise is low-effort and high-yield.
- Verify CVE-2026-8467 patch status across any Convertr/Plausible-integrated assets.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.