Updated XCSSET macOS Malware Steals Telegram Sessions and Browser Credentials

Researchers reported that an updated XCSSET malware strain expanded its data-theft capabilities on macOS, using malicious AppleScript files to collect and compress sensitive data from multiple applications before exfiltrating it to attacker-controlled infrastructure. The malware was found targeting Telegram session data stored in application sandbox and group container directories, creating a path for account takeover on another Mac, while also harvesting information from Contacts, Evernote, Notes, Opera, Skype, and WeChat.

The updated malware also targeted Google Chrome by displaying a fake privilege prompt to obtain the browser’s safe_storage_key, which it then used to decrypt and upload stored passwords and other sensitive data. Researchers said the operators rotated multiple command-and-control domains and IP addresses and modified the malware’s Xcode project infection chain so newer variants downloaded payloads remotely instead of embedding additional malicious files locally.