New XCSSET macOS Malware Variant Steals Data and Crypto

Microsoft has uncovered a new variant of the XCSSET macOS malware, which is targeting users' sensitive data, including cryptocurrency wallets and information stored in the Notes app. Active for at least five years, this malware spreads through compromised Xcode projects. The latest attacks used its first known variant since 2022, with the new version enjoying more sophisticated anti-detection techniques and additional infection strategies.

This variant employs enhanced code obfuscation using Base64 and xxd encoding, making analysis more challenging. Additionally, it features new persistence mechanisms through the zshrc file and macOS dock. The zshrc method creates a hidden payload file (~/.zshrc_aliases) and modifies the ~/.zshrc file to execute the payload whenever a new shell session starts.

The dock method downloads a signed dockutil tool from the attacker’s command-and-control (C2) server, then creates a fake Launchpad application which replaces the legitimate Launchpad’s path entry in the dock. Due to this, whenever Launchpad is started from the dock, the legitimate application and malicious payload are run simultaneously.

XCSSET latest variant exploits Xcode projects by embedding its payload via the TARGET, RULE, or FORCED_STRATEGY options. It can also modify the TARGET_DEVICE_FAMILY key to delay execution until a later stage.

Once inside a system, XCSSET’s modules extract sensitive information, including stored logins, browser data, chat application records, system files, and cryptocurrency wallet details. The malware’s operators leverage this data for financial theft and to gain unauthorized access to personal accounts. Apple previously addressed a zero-day vulnerability exploited by XCSSET in 2021.

To protect against infection, Microsoft advises developers to thoroughly inspect Xcode projects and avoid downloading code from unofficial sources. As XCSSET relies on stealth and obfuscation, it’s essential to remain vigilant and follow cybersecurity best practices.