XCSSET
XCSSET is macOS malware that targets Xcode developers by infecting Xcode projects and spreading via GitHub repositories. It is largely implemented in AppleScript, with additional bash commands and the ability to download and execute Python scripts for obfuscation. The malware embeds itself in Xcode using hidden folders such as .xcassets and .git.
Documented capabilities include file collection and exfiltration over its command-and-control channel, screenshot capture, credential theft, browser manipulation, clipboard hijacking, persistence, and file encryption. It retrieves files matching patterns defined in its INAME_QUERY variable from the user’s home directory, archives them, and exfiltrates them over C2. It can also compress the entire ~/Desktop directory excluding .git folders when the total size is under 200 MB. XCSSET saves periodic screen captures as numbered .jpg files and has been observed using CVE-2021-30713, a TCC bypass, to capture desktop screenshots without prompting the user. It can prompt for credentials using a native macOS dialog via /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment, and it can replace a legitimate browser with a malicious browser application to continuously capture credentials, monitor web traffic, and download additional modules. Reported newer variants also introduced browser targeting, clipboard hijacking, and persistence changes.
XCSSET performs host discovery and targeting checks, including using AppleScript with "user locale of (get system info)" to determine the host language and location, and using ps aux with grep to enumerate common browsers and system processes that may affect exfiltration. It uses scp to access ~/Library/Cookies/Cookies.binarycookies.
Persistence mechanisms include cron-based persistence alongside its primary infection vector. The malware has also used osacompile to compile AppleScript payloads into .app bundles and mdfind to locate installed applications with desired permissions.
XCSSET has been associated with multiple macOS zero-day and bypass techniques. It was discovered exploiting a TCC bypass in August 2020, later patched by Apple in May 2021 / macOS 11.4, by placing a trojan application inside the bundle of an application that already had TCC permissions. It maintained a hardcoded list of donor applications expected to have screen capture permissions, used mdfind to locate them, downloaded a screenshot module to ~/Library/Caches/GameKit, compiled it with osacompile into avatarde.app, modified Info.plist to set LSUIElement, optionally ad-hoc signed it on macOS 11+, and inserted it into donor app bundles so the injected app inherited TCC permissions. If direct bypass failed, it could impersonate Finder and socially engineer the user into granting access. Content also states XCSSET has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP, and earlier reporting noted zero-days used to steal Safari cookies protected by SIP and bypass prompts to install a developer version of Safari.
Known command-and-control domains listed in the content include trendmicronano[.]com, findmymacs[.]com, adoberelations[.]com, statsmag[.]com, statsmag[.]xyz, flixprice[.]com, adobestats[.]com, titiez[.]com, icloudserv[.]com, atecasec[.]com, monotel[.]xyz, sidelink[.]xyz, mantrucks[.]xyz, linebrand[.]xyz, and nodeline[.]xyz. The content also notes XCSSET encrypts files under ~/Documents, ~/Downloads, and ~/Desktop using AES-CBC with a fixed key and renames them with a .enc extension.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"XCSSET, which is macOS malware that was uncovered a few years ago and has various capabilities (from stealing victims’ app information to taking screenshots) was previously found exploiting CVE-2021-30713, a vulnerability allowing threat actors to bypass the TCC framework, for instance." | XCSSET, which is macOS malware that was uncovered a few years ago and has various capabilities (from stealing victims’ app information to taking screenshots) was previously found exploiting CVE-2021-30713... to bypass the TCC framework.
Techniques & procedures
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
4 techniques
Execution
Today we look at cron - a classic Unix mechanism that is very much alive on modern macOS Sonoma... User-level crontabs are stored in: /usr/lib/cron/tabs/<username>... The persistence installer (pers.c) installs a cron job for the current user... The cron entry installed looks like this: * * * * * /Users/Shared/hack
As with the Automation request, this only requires the user to click-through their consent rather than provide a password.
Persistence
1 technique
Persistence
Today we look at cron - a classic Unix mechanism that is very much alive on modern macOS Sonoma... User-level crontabs are stored in: /usr/lib/cron/tabs/<username>... The persistence installer (pers.c) installs a cron job for the current user... The cron entry installed looks like this: * * * * * /Users/Shared/hack
Privilege Escalation
3 techniques
Privilege Escalation
Today we look at cron - a classic Unix mechanism that is very much alive on modern macOS Sonoma... User-level crontabs are stored in: /usr/lib/cron/tabs/<username>... The persistence installer (pers.c) installs a cron job for the current user... The cron entry installed looks like this: * * * * * /Users/Shared/hack
APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263 to escalate privileges. ... APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host. ... multiple groups/tools exploit various CVEs to escalate privileges. | XCSSET has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.
Stealth
6 techniques
Stealth
The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.
If the bypass fails, it’s a simple matter to just impersonate the Finder and ask the user for control... Fake Finder App used by XCSSET malware to access protected areas
When macOS Mojave first went on public release, SentinelOne was the first to note that TCC could be bypassed via SSH... The most recent TCC bypass came to light after it was discovered being exploited by XCSSET malware in August 2020.
Agent Tesla has created hidden folders. AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings. APT28 has saved files with hidden file attributes. FIN13 has created hidden files and folders within a compromised Linux system /tmp directory and also used attrib.exe to hide gathered local host information.
Credential Access
3 techniques
Credential Access
Bundlore prompts the user for their credentials. Calisto presents an input prompt asking for the user's login and password. Cuckoo Stealer has captured passwords by prompting victims with a "macOS needs to access System Settings" GUI window. Dok prompts the user for credentials. FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials. iKitten prompts the user for their credentials. Keydnap prompts the users for credentials. Proton prompts users for their credentials. RedCurl prompts the user for credentials through a Microsoft Outlook pop-up. SILENTTRINITY's credphisher.py module can prompt a current user for their credentials. XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment.
Discovery
6 techniques
Discovery
"XCSSET uses ps aux with the grep command to enumerate common browsers and system processes"; "SpicyOmelette can enumerate running software"
an attacker, red teamer or malware could instead enumerate over the contents of the /Applications folder and take educated guesses based on what’s found there, e.g., Xcode, Camtasia, and Zoom are all applications that, if installed, are likely to be privileged.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
Use mdfind to search for apps to infect # # Allows an attacker to determine if specific applications are installed and can be leveraged set appId to do shell script "mdfind kMDItemCFBundleIdentifier = '" & bundleId & "'"
Use mdfind to search for AWS Keys # # Allows an attacker to query the filesystem via the CommandLine/Terminal to search for AWS keys. mdfind 'kMDItemTextContext == AKIA || kMDItemDisplayName = *AKIA* -onlyin ~'
Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities... Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian... Clop has checked the keyboard language using the GetKeyboardLayout() function... Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage.
Collection
5 techniques
Collection
The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.
Bundlore prompts the user for their credentials. Calisto presents an input prompt asking for the user's login and password. Cuckoo Stealer has captured passwords by prompting victims with a "macOS needs to access System Settings" GUI window. Dok prompts the user for credentials. FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials. iKitten prompts the user for their credentials. Keydnap prompts the users for credentials. Proton prompts users for their credentials. RedCurl prompts the user for credentials through a Microsoft Outlook pop-up. SILENTTRINITY's credphisher.py module can prompt a current user for their credentials. XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment.
"Agent Tesla can capture screenshots of the victim’s desktop"; "AppleSeed can take screenshots on a compromised host"; "APT28 has used tools to take screenshots from victims"; "Cobalt Strike's Beacon payload is capable of capturing screenshots"; "PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals"; "Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop"
Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP... Tomiris can upload files matching a hardcoded set of extensions... PowerShower packed and exfiltrated .txt, .pdf, .xls or .doc files smaller than 5MB modified during the past two days.
Command and Control
1 technique
Command and Control
Exfiltration
1 technique
Exfiltration
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
IOCs tracked for this family
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
43 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
macOS malware family referenced as being blocked by Gatekeeper due to missing code signing rather than XProtect YARA detection.
macOS malware targeting Xcode developers that used cron-based persistence to survive cleanup attempts.
macOS malware with updated obfuscation and persistence; new variant observed in limited attacks; first known variant since 2022.
Updated macOS malware variant with changes in browser targeting (Firefox), clipboard hijacking/clipper behavior, and persistence mechanisms; uses encryption/obfuscation.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.