Malware

XcodeSpy

XcodeSpy is a macOS malware campaign centered on trojanized Xcode projects used to target Apple software developers. It abuses Xcode’s Run Script build-phase functionality so that opening or building a malicious project executes hidden shell logic and installs a customized variant of the EggShell backdoor. The malware has been associated with a doctored copy of a legitimate open-source Xcode project and represents a developer-focused supply-chain style intrusion vector.

On infected systems, XcodeSpy deploys a persistent backdoor on macOS, commonly using LaunchAgents for persistence and masquerading its components as Apple-related files and directories. The customized EggShell payload provides remote access and surveillance capabilities, including keylogging, microphone and camera recording, screen capture, file upload and download, and clipboard access. It also supports broader post-compromise activity through backdoor functionality and covert data collection.

XcodeSpy is notable for targeting developers rather than general consumers, making it relevant to software supply-chain risk and espionage-oriented operations. Reporting has linked the campaign to custom EggShell samples active in 2020, with at least one confirmed victim in a U.S. organization and indications of additional targeting in Asia. The operation has been discussed in connection with suspected North Korean threat activity, but attribution remains cautious. XcodeSpy illustrates how trusted development workflows and shared project files can be weaponized to gain initial access and establish long-term surveillance on macOS endpoints.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

The script creates a hidden file called .tag in the /tmp directory, which contains a single command: mdbcmd . This in turn is piped via a reverse shell to the attackers C2.

T1059.004Unix ShellEvidence1

The XcodeSpy version, however, has been subtly changed to execute an obfuscated Run Script when the developer’s build target is launched.

Persistence

1 technique

T1543.001Launch AgentEvidence1

On execution, the customized EggShell binaries drop a LaunchAgent either at ~/Library/LaunchAgents/com.apple.usagestatistics.plist or ~/Library/LaunchAgents/com.apple.appstore.checkupdate.plist.

Privilege Escalation

1 technique

T1543.001Launch AgentEvidence1

On execution, the customized EggShell binaries drop a LaunchAgent either at ~/Library/LaunchAgents/com.apple.usagestatistics.plist or ~/Library/LaunchAgents/com.apple.appstore.checkupdate.plist.

Stealth

2 techniques

T1036MasqueradingEvidence1

XcodeSpy drops several files at paths using the “com.apple” reverse identifier and in subfolders named after legitimate macOS system software (TextEdit, Preview).

T1564.001Hidden Files and DirectoriesEvidence1

XcodeSpy hides several files with a dot prefix to make them hidden from view in the Finder application.

Credential Access

2 techniques

T1056.001KeyloggingEvidence1

The backdoor has functionality for recording the victim’s microphone, camera and keyboard... MITRE ATT&CK TTPs Input Capture: Keylogging | XcodeSpy can log user keystrokes to intercept credentials as the user types them T1056 001.

T1056.002GUI Input CaptureEvidence1

MITRE ATT&CK TTPs Input Capture: GUI Input Capture | XcodeSpy can prompt users for credentials with a seemingly legitimate prompt via AppleScript T1056 002.

Discovery

2 techniques

T1057Process DiscoveryEvidence1

MITRE ATT&CK TTPs Process Discovery | XcodeSpy can collect data on running and parent processes T1057.

T1083File and Directory DiscoveryEvidence1

MITRE ATT&CK TTPs File and Directory Discovery | XcodeSpy can scan directories on a compromised host T1083.

Collection

2 techniques

T1056.001KeyloggingEvidence1

T1056.002GUI Input CaptureEvidence1

MITRE ATT&CK TTPs Input Capture: GUI Input Capture | XcodeSpy can prompt users for credentials with a seemingly legitimate prompt via AppleScript T1056 002.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

MITRE ATT&CK TTPs Application Layer Protocol: Web Protocols | XcodeSpy can use HTTPS in C2 Communications T1071 001.

T1105Ingress Tool TransferEvidence1

The script contacts the attackers’ C2 and drops a custom variant of the EggShell backdoor on the development machine.

INDICATORS OF COMPROMISE

IOCs tracked for this family

30 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

14 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

8 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

uri●●●●●●●●●●●●View more in app1 year ago

domain●●●●●●●●●●●●View more in app1 year ago

hash.sha1●●●●●●●●●●●●View more in app1 year ago

domain●●●●●●●●●●●●View more in app1 year ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

emsisoftNews

Nov 20, 2025

Mac Specific Threats and Analysis

Trojan embedded in tampered Xcode projects targeting developers, establishing a persistent backdoor.

sentinelone labs subdomainNews

Jun 10, 2025

New macOS Malware XcodeSpy Targets Xcode Developers with EggShell Backdoor - SentinelLabs

A trojanized Xcode project targeting Apple developers via Xcode’s Run Script feature. It executes an obfuscated script, contacts attacker C2, drops a custom EggShell backdoor, establishes persistence with LaunchAgents, and enables microphone, camera, keyboard capture, plus file upload/download.

sentinelone blogNews

Mar 22, 2023

Session Cookies, Keychains, SSH Keys and More | 7 Kinds of Data Malware Steals from macOS Users

Referenced as the malware campaign/tooling in which a customized EggShell RAT variant was used.

objective seeNews

Jan 1, 2022

The Mac Malware of 2021 👾

Malware that targets macOS developers by infecting Xcode projects with a malicious script, which installs the EggShell backdoor for remote access and surveillance.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching30

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

XcodeSpy