Cybersecurity researchers have discovered an updated version of a known Apple macOS malware called XCSSET that has been observed in limited attacks.
“This new variant of XCSSET brings key changes related to browser targeting, clipboard hijacking, and persistence mechanisms,” the Microsoft Threat Intelligence team said in a Thursday report.
“It employs sophisticated encryption and obfuscation techniques, uses run-only compiled AppleScripts for stealthy execution, and expands its data exfiltration capabilities to include Firefox browser data. It also adds another persistence mechanism through LaunchDaemon entries.”
XCSSET is the name assigned to a sophisticated modular malware that’s designed to infect Xcode projects used by software developers and unleash its malicious capabilities when it’s being built. Exactly how the malware is distributed remains unclear, but it’s suspected that the propagation relies on the Xcode project files being shared among developers building apps for macOS.
Earlier this March, Microsoft uncovered several enhancements to the malware, highlighting its improved error handling and the use of three different persistence techniques to siphon sensitive data from compromised hosts.
The latest variant of XCSSET has been found to incorporate a clipper sub-module that monitors clipboard content for specific regular expression (aka regex) patterns matching various cryptocurrency wallets. In the event of a match, the malware proceeds to substitute the wallet address in the clipboard with an attacker-controlled one to reroute transactions.
The Windows maker also noted that the new iteration introduces changes to the fourth stage of the infection chain, particularly where an AppleScript application is used to run a shell command to fetch the final-stage AppleScript that’s responsible for collecting system information and launching various sub-modules using a boot() function.
Notably, the modifications include extra checks for the Mozilla Firefox browser and an altered logic to determine the presence of the Telegram messaging app. Also observed are changes to the various modules, as well as new modules that did not exist in previous versions –
- vexyeqj, the information module previously called seizecj, and which downloads a module called bnk that’s run using osascript. The script defines functions for data validation, encryption, decryption, fetching additional data from command-and-control (C2) server, and logging. It also includes the clipper functionality.
- neq_cdyd_ilvcmwx, a module similar to txzx_vostfdi that exfiltrates files to the C2 server
- xmyyeqjx, a module to set up LaunchDaemon-based persistence
- jey, the module previously called jez, and which is used to set up Git-based persistence
- iewmilh_cdyd, a module to steal data from Firefox using a modified version of a publicly available tool named HackBrowserData
To mitigate the threat posed by XCSSET, users are recommended to ensure that they keep their system up-to-date, inspect Xcode projects downloaded or cloned from repositories or other sources, and exercise caution when it comes to copying and pasting sensitive data from the clipboard.
Sherrod DeGrippo, Director of Threat Intelligence Strategy at Microsoft, told The Hacker News that the modules regularly undergo small name changes as the malware evolves, despite its functionality remaining consistent.
“What stands out in this variant is its ability to intercept and tamper with clipboard content tied to digital wallets,” DeGrippo said. “This isn’t passive reconnaissance; it’s a threat that will undermine trust in something as basic as what you copy and paste.
“The latest XCSSET evolution shows how even developer tools can be weaponized. With tactics like clipboard hijacking, expanded browser targeting, and stealth persistence, threat actors continue to raise the level of sophistication defenders need to guard against.”
(The story was updated after publication to include a response from Microsoft.)
