Nasty macOS Malware XCSSET added More Features to its Toolset

guest · Jul 23, 2021

Nasty macOS Malware XCSSET Now Targets Google Chrome, Telegram Software
July 23, 2021
https://thehackernews.com/2021/07/nasty-macos-malware-xcsset-now-targets.html

A malware known for targeting macOS operating system has been updated once again to add more features to its toolset that allows it to amass and exfiltrate sensitive data stored in a variety of apps, including apps such as Google Chrome and Telegram, as part of further "refinements in its tactics."

XCSSET was uncovered in August 2020, when it was found targeting Mac developers using an unusual means of distribution that involved injecting a malicious payload into Xcode IDE projects that's executed at the time of building project files in Xcode.
Click to expand...

Earlier this April, XCSSET received an upgrade that enabled the malware authors to target macOS 11 Big Sur as well as Macs running on M1 chipset by circumventing new security policies instituted by Apple in the latest operating system.

Aside from Chrome and Telegram, XCSSET also has the capacity to plunder valuable information from a variety of apps like Evernote, Opera, Skype, WeChat, and Apple's own Contacts and Notes apps by retrieving said data from their respective sandbox directories.

"The discovery of how it can steal information from various apps highlights the degree to which the malware aggressively attempts to steal various kinds of information from affected systems," the researchers said.
Click to expand...

Trend Micro: Updated XCSSET Malware Targets Telegram, Other Apps

In our last update on the XCSSET campaign, we updated some of its features targeting latest macOS 11 (Big Sur). Since then, the campaign added more features to its toolset, which we have continually monitored. We have also discovered the mechanism used to steal information from various apps, a behavior that has been present since we first discussed XCSSET.
Click to expand...

guest · Aug 23, 2022

XCSSET Malware Updates with Python 3 to Target macOS Monterey Users
August 23, 2022

The operators of the XCSSET macOS malware have upped the stakes by making iterative improvements that add support for macOS Monterey by upgrading its source code components to Python 3.

"The malware authors have changed from hiding the primary executable in a fake Xcode.app in the initial versions in 2020 to a fake Mail.app in 2021 and now to a fake Notes.app in 2022," SentinelOne researchers Phil Stokes and Dinesh Devadoss said in a report.
XCSSET, first documented by Trend Micro in 2020, has many moving parts that allow it to harvest sensitive information from Apple Notes, WeChat, Skype, and Telegram; inject malicious JavaScript code into various websites; and dump cookies from Safari web browser.
Click to expand...

The primary executable is an AppleScript that's designed to retrieve second-stage AppleScript payloads from a network of remote servers that siphon data stored in web browsers such as Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, and Yandex Browser as well as chat apps like Telegram and WeChat.

Besides leveraging AppleScripts, the malware also takes advantage of Python scripts for dropping fake application icons on the macOS Dock and stealing data from the legitimate Notes app.
Click to expand...

The latest version of XCSSET is also notable for incorporating modifications to AppleScripts to account for Apple's removal of Python 2.7 from macOS 12.3 released on March 14, 2022, indicating that the authors are continually updating the malware to increase their chance of success.
To that end, the adversary is said to have updated their "safari_remote.applescript" by eliminating Python 2 in favor of Python 3 for systems running macOS Monterey 12.3 and above.

Despite being in the wild for two years, very little is known about the identity of the threat actors and their motivations or their exact targets.
Click to expand...

SentinelOne: XCSSET Malware Update | macOS Threat Actors Prepare for Life Without Python

Threat actors behind the XCSSET malware have been relatively quiet since last year. However, new activity beginning around April 2022 and increasing through May to August shows that actors have not only adapted to changes in macOS Monterey, but are preparing for the demise of Python, an integral and essential part of their current toolkit.

In this post, we review changes made to the latest versions of XCSSET and reveal some of the context in which these threat actors operate.
Click to expand...

Log in or Sign up

Nasty macOS Malware XCSSET added More Features to its Toolset

guest Guest

guest Guest

Log in or Sign up

Nasty macOS Malware XCSSET added More Features to its Toolset

guest Guest

guest Guest

Useful Searches