Loading malware…
XCSSET is a modular macOS malware family that targets software developers in the Apple ecosystem, primarily by infecting Xcode projects and propagating through poisoned development repositories in supply-chain-style attacks. First publicly identified in 2020 and still evolving in later variants, it is notable for abusing developer workflows to execute when a victim builds a compromised project locally. XCSSET has been associated with attacks against macOS developers and has shown particular focus on Apple-centric development environments.
The malware is implemented largely with AppleScript and shell-based components, with newer variants adding more modular loaders, staged execution, and memory-resident core functionality. Observed infection chains include an initial loader or downloader embedded into project files, reconnaissance of the host, temporary staging applets, and a final orchestrator that loads additional modules in memory while deleting staging artifacts from disk. XCSSET has used hidden directories inside Xcode projects and Git-related locations to conceal itself and maintain access to developer repositories.
XCSSET supports a broad post-compromise feature set. Documented capabilities include credential theft through native-looking macOS prompts, browser replacement or hijacking to capture credentials and monitor web traffic, clipboard hijacking, screenshot capture, cookie theft, file collection, compression and archival of victim data, and exfiltration over its command-and-control channel. Some variants search user directories for files matching operator-defined patterns and size limits, while others compress desktop contents or collect browser-related data. Newer modules have been reported to abuse browser debugging interfaces for session theft, traffic interception, script injection into webpages, and command execution resembling a fileless reverse shell. XCSSET has also been observed replacing legitimate applications with trojanized copies to sustain credential capture and module delivery.
Persistence is a core feature of the family. Reported mechanisms include Git hooks, Launch Daemons, cron jobs, shell profile modification, trojanized applications, Dock-related persistence, and fileless storage of staged payloads in macOS preference domains. The malware also employs extensive defense-evasion measures, including polymorphic rebuilding of components, encrypted modules and communications, string and symbol obfuscation, hidden files and folders, anti-VM checks, and cleanup of installation artifacts after execution.
XCSSET is also notable for abusing or bypassing macOS security controls. Multiple campaigns exploited weaknesses in Transparency, Consent, and Control to inherit permissions from trusted applications and access protected resources such as screen recording without prompting the user. Earlier reporting also tied XCSSET to theft of Safari cookies protected by System Integrity Protection. Additional observed behavior includes checking firewall-related configuration, querying host locale and location, enumerating browsers and processes, and selectively adapting execution based on the environment.
Overall, XCSSET is a sophisticated macOS threat best characterized as a developer-focused infostealer and backdoor platform delivered through poisoned Xcode projects. Its combination of supply-chain propagation, modular in-memory execution, credential and session theft, persistence, and macOS-specific security bypasses makes it one of the more significant malware families targeting Apple developer environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"XCSSET, which is macOS malware that was uncovered a few years ago and has various capabilities (from stealing victims’ app information to taking screenshots) was previously found exploiting CVE-2021-30713, a vulnerability allowing threat actors to bypass the TCC framework, for instance." | XCSSET, which is macOS malware that was uncovered a few years ago and has various capabilities (from stealing victims’ app information to taking screenshots) was previously found exploiting CVE-2021-30713... to bypass the TCC framework.
39 distinct techniques documented for this family, organized by ATT&CK tactic.
The chrome_remote binary intercepts this console event, strips the delimiter and passes the remaining payload to the host's underlying shell handler ( exec.Command ). | The moment the developer builds the project locally, a malicious run-script phase executes silently in the background.
To eliminate forensic evidence, the loader wrapper is executed in memory by osascript, which in turn downloads the main orchestrator module and its AppleScript loader.
If the C2 approves the host profile, it returns a bash script obfuscated via a custom substitution cipher.
As with the Automation request, this only requires the user to click-through their consent rather than provide a password.
The author used a multi-layered cipher shift to conceal the threat’s internal functions.
V40 further enhances its detection evasion capabilities by combining polymorphic payload generation with fileless persistence and dynamic in-memory execution.
It then reloads a TCC prompt, masquerading as System Settings or Xcode to trick the user into re-granting automation permissions to the malware's bundle ID.
The moment this memory-resident core module loop becomes active, the malware terminates its staging processes and deletes all installation files from the disk.
The malware dynamically scrambles its payload generation at compile time, switching between nested layers of Hex- and Base64-encoding.
When macOS Mojave first went on public release, SentinelOne was the first to note that TCC could be bypassed via SSH... The most recent TCC bypass came to light after it was discovered being exploited by XCSSET malware in August 2020.
Hosts reporting a virtual environment receive no further module deliveries, ensuring that automated sandboxes do not analyze XCSSET’s core logic.
Agent Tesla has created hidden folders. AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings. APT28 has saved files with hidden file attributes. FIN13 has created hidden files and folders within a compromised Linux system /tmp directory and also used attrib.exe to hide gathered local host information.
Copy this new “ls.app” trojan to inside the bundle of an app that’s already been given TCC permission to access the Desktop. % cp -R /tmp/ls.app /Applications/Some Privileged.app/ ... Execute the trojan app
The goal of the core-module ... is to execute and load additional, specialized modules into memory, such as keyloggers, clipboard hijackers or browser hijackers.
The payload queries the operating system type ( uname -s ) and the current username ( whoami ), transmitting these details back to the C2 endpoint.
It can now infect all existing Xcode projects on a compromised system for maximum impact.
Hosts reporting a virtual environment receive no further module deliveries, ensuring that automated sandboxes do not analyze XCSSET’s core logic.
Use mdfind to search for apps to infect # # Allows an attacker to determine if specific applications are installed and can be leveraged set appId to do shell script "mdfind kMDItemCFBundleIdentifier = '" & bundleId & "'"
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.
Use mdfind to search for AWS Keys # # Allows an attacker to query the filesystem via the CommandLine/Terminal to search for AWS keys. mdfind 'kMDItemTextContext == AKIA || kMDItemDisplayName = *AKIA* -onlyin ~'
Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities... Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian... Clop has checked the keyboard language using the GetKeyboardLayout() function... Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage.
The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.
The goal of the core-module ... is to execute and load additional, specialized modules into memory, such as keyloggers, clipboard hijackers or browser hijackers.
Threats in this family download task-specific modules from a C2 server, giving it capabilities including: ... Clipboard monitoring
Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP... Tomiris can upload files matching a hardcoded set of extensions... PowerShower packed and exfiltrated .txt, .pdf, .xls or .doc files smaller than 5MB modified during the past two days.
The chrome_remote binary dropped by the browser hijacking module establishes a persistent WebSocket connection to the C2 server to pull down real-time JavaScript payloads.
68 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A macOS malware family that targets developers via Xcode.
A modular macOS malware family targeting software developers in the Apple ecosystem via poisoned Xcode projects and vulnerable Git repositories. The v40 variant is heavily memory-resident and polymorphic, uses fileless persistence, downloads task-specific modules from C2, infects local Xcode projects for worm-like propagation, steals credentials and data, hijacks browsers, trojanizes Telegram Desktop, impairs macOS defenses, and exfiltrates information.
macOS malware family referenced as being blocked by Gatekeeper due to missing code signing rather than XProtect YARA detection.
macOS malware targeting Xcode developers that used cron-based persistence to survive cleanup attempts.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.