XCSSET macOS malware reappears with new attack strategies, Microsoft sounds alarm – Source: www.csoonline.com

Microsoft has warned that a new variant of XCSSET malware is actively targeting macOS users, marking the first update to the malware since 2022.

This latest version has been observed in limited attacks but introduces stronger evasion tactics, updated persistence mechanisms, and new infection strategies that make it more difficult to detect and remove. The malware, which spreads through infected Xcode projects, continues to pose a significant threat to developers and enterprises relying on Apple’s software development ecosystem.

“The latest XCSSET malware features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies,” Microsoft said in its report posted on X. The malware retains its previous capabilities, including stealing digital wallet data, collecting sensitive files, and exfiltrating user information.

Microsoft has urged macOS developers to remain vigilant and thoroughly inspect Xcode projects before use.

New stealth and persistence techniques

The new XCSSET variant employs advanced obfuscation techniques to evade detection. According to Microsoft, the malware randomizes encoding techniques and iterations, incorporating Base64 encoding alongside traditional xxd (hexdump) encoding to make analysis more difficult.

Additionally, “at its code level, the variant’s module names are also obfuscated, making it more challenging to determine the modules’ intent,” the report added.

Persistence is achieved through two key mechanisms, Microsoft revealed in the post. The zshrc method ensures the malware launches each time a new shell session is started by appending a malicious command to the ~/.zshrc file. Meanwhile, the dock method involves downloading a signed dockutil tool from the attacker’s command-and-control server. The malware then replaces the legitimate Launchpad entry with a fake version, ensuring the malicious payload is executed whenever Launchpad is opened.

“These enhancements make XCSSET much harder to detect and remove, reinforcing its ability to maintain long-term infections,” Microsoft noted in its advisory.

Xcode developers targeted through infected projects

Microsoft reported that XCSSET continues to spread via compromised Xcode projects, a technique that has been in use since the malware’s discovery in 2020. Once an infected project is cloned or downloaded, the malware can embed itself within the developer’s system and further propagate when the infected code is shared.

“The new XCSSET variant introduces new methods for where the payload is placed in a target Xcode project,” Microsoft explained in the post. The malware selects from TARGET, RULE, or FORCED_STRATEGY methods to inject malicious code. Additionally, it can place payloads inside the TARGET_DEVICE_FAMILY key under build settings, allowing it to execute later in the development cycle.

This attack method has proven particularly effective, as infected developers unknowingly distribute the malware when sharing their projects.

Security researchers at Trend Micro previously described XCSSET’s distribution model as “clever,” noting that traditional verification methods such as checking file hashes are ineffective since developers themselves are unknowingly packaging the compromised files.

Growing macOS threat landscape and supply chain risks

Security experts warn that XCSSET’s evolution signals a growing threat to macOS, particularly through supply chain attacks that exploit trusted developer environments.

“The latest variant of XCSSET is a clear sign that macOS threats are becoming more advanced, particularly targeting developers,” said Arjun Chauhan, Practice Director at Everest Group. “With its improved stealth tactics, stronger persistence methods, and better infection techniques, this version is harder to detect and remove.”

Chauhan also pointed out that attackers are increasingly focusing on macOS, fueled by the rise of malware-as-a-service (MaaS). “The fact that XCSSET compromises Xcode projects is especially concerning because it enables a supply chain attack—meaning the malware can spread beyond just the developer’s system to the end-users of infected apps,“ he noted.

“This shift indicates that cybercriminals are looking for high-impact entry points within Apple’s ecosystem, leveraging the trust that users place in developers,” Chauhan added.

Security measures and Microsoft’s recommendations

Microsoft Defender for Endpoint on Mac can detect the new XCSSET variant, claimed the advisory, but developers and organizations are advised to take additional precautions.

“Users must always inspect and verify any Xcode projects downloaded or cloned from repositories, as the malware usually spreads through infected projects,” Microsoft warned. The company also emphasized that applications should only be installed from trusted sources, such as official app stores, to mitigate risks.

Security researchers have long observed XCSSET exploiting vulnerabilities in macOS to bypass Transparency, Consent, and Control (TCC) protections, enabling it to record screens, steal credentials, and access sensitive data from applications like Telegram, Chrome, and Skype.

With this latest update, Microsoft has warned that macOS threats are evolving rapidly, making proactive security measures essential. As attackers continue refining their methods, enterprises, and software developers are advised to prioritize threat detection, adopt endpoint security solutions, and enforce strict software verification practices to safeguard their environments against this growing macOS malware threat.