Loading story…
The Flutter package universal_file_viewer version 0.1.5 was published to pub.dev with XCSSET malware embedded in its example-project files. Its Dart library code was clean, so consuming the package as a dependency does not execute the payload; exposure occurs when developers clone the repository and build the example app locally. The infection appears to have originated from the maintainer's already compromised workstation rather than a targeted takeover of the package or its users.
The malicious files inject Android Gradle, Xcode, and Git pre-commit hooks that contact command-and-control infrastructure and can spread to other developer projects. XCSSET is a macOS-focused developer supply-chain malware family that has evolved to steal browser data—including Safari and Firefox credentials, cookies, and history—Telegram, notes, clipboard contents, and local files; it can also replace copied cryptocurrency wallet addresses. The package sample uses disguised Dock-based persistence and AES-256-CBC-encrypted data exfiltration, while recent XCSSET variants have added stronger persistence, stealthy AppleScript-based execution, and expanded Xcode-project propagation.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft's September 2025 analysis referenced changes to XCSSET that had previously been described in a March 2025 Microsoft blog post, including obfuscation and persistence techniques for infecting Xcode projects.
The infection included malicious Android Gradle preBuild hooks, Xcode PBXBuildRule entries, and Git pre-commit hooks that contact C2 infrastructure and can propagate into other Android, Xcode, and Git projects. The reported payload also establishes disguised persistence and steals browser, messaging, clipboard, notes, and local-file data for AES-256-CBC-encrypted exfiltration.
The pub.dev package universal_file_viewer version 0.1.5 was found to include XCSSET-infected files in its example directory after being traced to a compromised GitHub repository. Its Dart library code was clean, and ordinary dependency installation did not execute the malicious code; risk arose when building the cloned example project locally.
Microsoft shared its XCSSET findings with Apple and worked with GitHub to remove infected repositories associated with the campaign.
The newly analyzed XCSSET variant added a Firefox-focused stealer based on a modified HackBrowserData binary and a persistence module that creates a LaunchDaemon and can disable macOS update protections. It can also replace copied cryptocurrency wallet addresses with attacker-controlled addresses based on C2-supplied patterns.
Microsoft Threat Intelligence identified a new XCSSET variant in the wild that infects Xcode projects during builds and adds browser-data theft, cryptocurrency clipboard hijacking, and enhanced persistence. Microsoft said the activity had been observed only in limited attacks at the time of its analysis.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 30 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
aikido.dev
Open sourcemicrosoft.com
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed **FlutterShell**, a macOS backdoor tied to **Operation FlutterBridge** and tracking cluster `CL-CRI-1089`, which was distributed through malicious Google and YouTube ads leading users to fake download sites for trojanized productivity apps. The malware arrived as digitally signed app bundles and used a two-part design: a lightweight launcher loaded a larger Flutter/Dart payload library, while a hidden `WKWebView` fetched attacker-controlled JavaScript from live command-and-control infrastructure to deliver commands at runtime. Analysis of ten Mach-O samples found three malware generations that changed certificates, lures, infrastructure, and command names, with the latest version adding full Dart symbol obfuscation to reduce static visibility. Despite those changes, researchers identified stable traits across payloads, including a shared exported-symbol fingerprint and consistent Flutter runtime behavior. Reported capabilities included hardware UUID fingerprinting, Chrome Secure Preferences modification to hijack browser search settings, persistence via `LaunchAgent`, and Sparkle-based silent replacement, indicating a financially motivated campaign that relied on behavioral stealth and server-side control.
Jun 29, 2026
A new variant of the XCSSET macOS malware has been identified by Microsoft Threat Intelligence, demonstrating significant advancements in its capabilities and targeting. This updated version of XCSSET is specifically designed to infect Xcode projects, which are commonly used by software developers building applications for macOS. The malware leverages the sharing of Xcode project files among developers as its primary propagation method, allowing it to spread stealthily within development environments. Researchers have observed that the latest variant introduces sophisticated encryption and obfuscation techniques, making detection and analysis more challenging. One of the key enhancements is the use of run-only compiled AppleScripts, which enable stealthy execution and help evade security tools. The malware has expanded its data exfiltration capabilities to include the theft of browser data from Mozilla Firefox, in addition to previously targeted browsers. To achieve this, it installs a modified build of the open-source HackBrowserData tool, which is capable of decrypting and exporting sensitive browser data. Another notable feature is the addition of a clipper sub-module that actively monitors the system clipboard for patterns matching cryptocurrency wallet addresses. When such an address is detected, the malware replaces it with an attacker-controlled address, effectively hijacking cryptocurrency transactions and redirecting funds to the threat actors. The persistence mechanisms have also been improved, with the malware now creating LaunchDaemon entries and deploying a fake System Settings.app in the /tmp directory to maintain its foothold on compromised systems. The infection chain has been updated, particularly in the fourth stage, where an AppleScript application is used to execute a shell command that fetches the final-stage AppleScript responsible for system information collection and launching various sub-modules. Microsoft notes that the new variant has been observed only in limited attacks so far, but its advanced features and modular design pose a significant threat to macOS users, especially developers. The malware's ability to siphon sensitive data, including Notes, browser credentials, and cryptocurrency wallets, increases the risk of financial loss and data breaches. Enhanced error handling and the use of multiple persistence techniques further complicate remediation efforts. Microsoft has shared its findings with Apple to aid in the development of detection and mitigation strategies. The exact initial distribution vector remains unclear, but the reliance on infected Xcode projects highlights the importance of secure development practices. Organizations and individual developers are urged to review their Xcode environments for signs of compromise and to implement robust endpoint protection solutions. The discovery of this new XCSSET variant underscores the evolving threat landscape for macOS and the need for continuous vigilance among software development communities.
Jun 29, 2026
Palo Alto Networks Unit 42 reported that a cybercrime cluster tracked as **CL-CRI-1089** is running a large macOS malvertising operation that delivers a new Flutter-based backdoor called **FlutterShell**. The campaign uses hundreds of Google Ads placed through verified shell companies to lure users in Anglophone and Western European markets into downloading trojanized applications posing as legitimate desktop tools, including variants identified as **PodcastsLounge**, **PDF-Brain**, and **PDF-Ninja**. Once installed, FlutterShell can execute shell commands, manipulate files, and exfiltrate environment variables, while also altering Google Chrome preferences to hijack browser traffic for ad monetization. Researchers said the malware relies on a **WebView** JavaScript-to-native bridge that lets operators host malicious logic remotely and update behavior without recompiling the binary, making static analysis harder and enabling rapid changes in the campaign. Unit 42 linked FlutterShell to earlier CL-CRI-1089 activity on macOS, including **JSCoreRunner**, and to Windows malware families **RecipeLister** and **Calendaromatic**, indicating an expanding cross-platform operation. The findings also echo prior reporting on macOS adware loaders such as **Bundlore**, underscoring the continued use of deceptive software distribution and browser-focused monetization techniques against Apple users.
Jun 29, 2026