Loading story…
Researchers reported that an updated XCSSET malware strain expanded its data-theft capabilities on macOS, using malicious AppleScript files to collect and compress sensitive data from multiple applications before exfiltrating it to attacker-controlled infrastructure. The malware was found targeting Telegram session data stored in application sandbox and group container directories, creating a path for account takeover on another Mac, while also harvesting information from Contacts, Evernote, Notes, Opera, Skype, and WeChat.
The updated malware also targeted Google Chrome by displaying a fake privilege prompt to obtain the browser’s safe_storage_key, which it then used to decrypt and upload stored passwords and other sensitive data. Researchers said the operators rotated multiple command-and-control domains and IP addresses and modified the malware’s Xcode project infection chain so newer variants downloaded payloads remotely instead of embedding additional malicious files locally.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
On June 24, 2021, the attackers took the newer XCSSET servers offline. The malware's direct IP fallback in bootstrap.applescript would have helped preserve reachability even if domains were shut down.
From June 9 to June 10, 2021, previously used XCSSET C2 domains were removed and replaced with atecasec.info, datasomatic.ru, icloudserv.ru, lucidapps.info, relativedata.ru, revokecert.ru, and safariperks.ru. The malware's bootstrap component was updated to use the latest domains and a direct IP fallback.
On May 1, 2021, the domain irc-nbg.v001.com resolved to the original C2 IP address 94.130.27.189. The report noted it appeared to host an IRC server that did not seem related to XCSSET at the time.
From April 22, 2021 onward, all observed XCSSET command-and-control domain names resolved to 194.87.186.66. This marked a change in the malware's C2 infrastructure.
Between April 20 and April 22, 2021, researchers observed new XCSSET-related domains including atecasec.com, linebrand.xyz, mantrucks.xyz, monotal.xyz, nodeline.xyz, and sidelink.xyz resolving to 94.130.27.189. These domains used Let's Encrypt certificates valid from April 22 to July 21, 2021.
Trend Micro documented updated XCSSET malware features, including theft of Telegram session data, Chrome passwords, and data from Contacts, Evernote, Notes, Opera, Skype, and WeChat. The report also described new infection logic that downloads payloads remotely and a new canary module targeting Google Chrome Canary.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed a macOS malware campaign using **ClickFix-style malvertising** and fake Claude download lures to deploy **MacSync Stealer**, an infostealer built to harvest trusted local artifacts rather than rely only on stolen passwords. Victims were redirected from Google ads to spoofed shared Claude chat pages, then tricked into running a Base64-obfuscated shell command that launched multi-stage shell and AppleScript payloads. The malware collected Keychain data, browser credentials, password-manager and wallet extension data, Telegram files, shell histories, cloud keys, Apple Notes content, and selected documents, while also prompting for the macOS password and **Full Disk Access**; if blocked, it added persistence through `~/.zshrc` so it could retry on the next Terminal launch. The theft enabled direct account and asset compromise. SlowMist found the malware could restore stolen **Telegram Desktop** and **Telegram for macOS** session files on another Mac without triggering phone verification or Telegram two-step verification because it reused an already authorized local session. It also targeted **16 wallet applications** and **223 wallet-related browser extension IDs**, harvesting candidate passwords from multiple sources to decrypt wallet data offline. In a more active phase, the malware removed legitimate **Ledger** and **Trezor** apps and replaced them with malicious WebView loaders that displayed attacker-controlled phishing pages to capture recovery phrases. Investigators linked the campaign to multiple malicious domains and Google ad campaign IDs, and published IOCs including IP addresses, URLs, and SHA-256 hashes.
Jul 17, 2026
A new variant of the XCSSET macOS malware has been identified by Microsoft Threat Intelligence, demonstrating significant advancements in its capabilities and targeting. This updated version of XCSSET is specifically designed to infect Xcode projects, which are commonly used by software developers building applications for macOS. The malware leverages the sharing of Xcode project files among developers as its primary propagation method, allowing it to spread stealthily within development environments. Researchers have observed that the latest variant introduces sophisticated encryption and obfuscation techniques, making detection and analysis more challenging. One of the key enhancements is the use of run-only compiled AppleScripts, which enable stealthy execution and help evade security tools. The malware has expanded its data exfiltration capabilities to include the theft of browser data from Mozilla Firefox, in addition to previously targeted browsers. To achieve this, it installs a modified build of the open-source HackBrowserData tool, which is capable of decrypting and exporting sensitive browser data. Another notable feature is the addition of a clipper sub-module that actively monitors the system clipboard for patterns matching cryptocurrency wallet addresses. When such an address is detected, the malware replaces it with an attacker-controlled address, effectively hijacking cryptocurrency transactions and redirecting funds to the threat actors. The persistence mechanisms have also been improved, with the malware now creating LaunchDaemon entries and deploying a fake System Settings.app in the /tmp directory to maintain its foothold on compromised systems. The infection chain has been updated, particularly in the fourth stage, where an AppleScript application is used to execute a shell command that fetches the final-stage AppleScript responsible for system information collection and launching various sub-modules. Microsoft notes that the new variant has been observed only in limited attacks so far, but its advanced features and modular design pose a significant threat to macOS users, especially developers. The malware's ability to siphon sensitive data, including Notes, browser credentials, and cryptocurrency wallets, increases the risk of financial loss and data breaches. Enhanced error handling and the use of multiple persistence techniques further complicate remediation efforts. Microsoft has shared its findings with Apple to aid in the development of detection and mitigation strategies. The exact initial distribution vector remains unclear, but the reliance on infected Xcode projects highlights the importance of secure development practices. Organizations and individual developers are urged to review their Xcode environments for signs of compromise and to implement robust endpoint protection solutions. The discovery of this new XCSSET variant underscores the evolving threat landscape for macOS and the need for continuous vigilance among software development communities.
Jun 29, 2026
Microsoft reported that **information-stealing malware activity is expanding from Windows to macOS**, driven by campaigns observed since late 2025 that rely on social engineering and cross-platform tooling. The activity includes **ClickFix-style prompts** and **malicious DMG installers** that deliver macOS-focused infostealer families such as **Atomic macOS Stealer (AMOS)**, **MacSync**, and **DigitStealer**, with operators leveraging **fileless execution**, **native macOS utilities**, and **AppleScript automation** to evade defenses and automate collection. Initial access commonly starts with **malicious search ads (e.g., Google Ads)** that redirect users to fake sites impersonating legitimate tools and then trick victims into running “fix” steps or installing trojanized software. The malware is assessed to target high-value data including browser credentials and session cookies, **iCloud Keychain** contents, crypto wallet data, and **developer secrets**; Microsoft also highlighted growing use of **Python-based stealers** distributed via phishing for rapid adaptation across heterogeneous environments, citing **PXA Stealer** (linked to Vietnamese-speaking actors) as an example used in late-2025 campaigns with persistence mechanisms such as registry `Run` keys or scheduled tasks and **Telegram** used for command-and-control.
Jun 29, 2026