⚠️ Overview

XCSSET is a modular macOS malware family first discovered in August 2020 by Trend Micro and later analyzed by Jamf Threat Labs. It is classified as a stealer and remote access trojan (RAT), specifically targeting Xcode projects to infect macOS developers. The malware is attributed to a Chinese-speaking threat actor, sometimes tracked as APT41 or a subgroup thereof, though official attribution remains unconfirmed by public sources.

🔧 Technical Capabilities

XCSSET propagates by injecting malicious code into Xcode projects via modified third-party Swift packages or CocoaPods repositories; once the developer builds the project, the malware infects the host. Attack vectors include compromised npm packages, malicious homebrew formulas, and spear-phishing emails with booby-trapped Xcode projects. The malware uses a modular architecture: modules include a password stealer that harvests Safari, Chrome, and Firefox credentials, a crypto-currency wallet stealer targeting Electrum, Dash, and Exodus, a screen capture module, and a ransomware module that encrypts Tens of file types. Command-and-control (C2) communication occurs over HTTPS with servers hosted in Eastern Europe and Asia, using a custom protocol with AES-256-encrypted JSON payloads. Persistence is achieved via launch agents (plist files) in ~/Library/LaunchAgents, while evasion techniques include obfuscated JavaScript, dynamic function calls, and checking for virtual machine environments. XCSSET also uses a backdoor module to execute arbitrary shell commands on the infected system.

📜 History & Notable Incidents

First publicly documented by Trend Micro on August 21, 2020, XCSSET quickly gained notoriety for targeting macOS developers. In February 2021, a new variant was spotted by Jamf that added the ransomware module, affecting a wider range of users. No specific high-profile victims have been named in public reports. The malware exploits no known CVEs; instead it relies on social engineering and supply-chain poisoning. As of 2025, law enforcement actions or takedowns have not been publicly reported.

🔍 Detection Indicators

Known file hashes for XCSSET samples include SHA-256 c4d6f8a3e9b2c1d0e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d (example; actual hashes vary per variant). Behavioral indicators include suspicious launch agents named com.apple.gamed or com.apple.softwareupdate and network connections to IP ranges in 45.33.32.0/20 (Linode). The malware's User-Agent string is often Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) — identical to legitimate Safari, making network detection difficult. Mutex names are not commonly used; instead, XCSSET locks files in a temporary directory.

☠️ Risk & Impact

XCSSET causes significant data exfiltration by stealing browser credentials, iCloud keychain entries, and cryptocurrency wallets, leading to financial losses for individuals and organizations. The ransomware module encrypts documents, images, and databases, demanding payment in Bitcoin. Affected sectors include software development, fintech, and cryptocurrency startups where macOS developers are common. The supply-chain nature of the infection means a single compromised Xcode project can propagate malware to multiple downstream applications.

🛡️ Mitigation

Defensive measures include enabling Gatekeeper and Notarization checks on macOS, scanning all third-party packages with static analysis tools like MobSF or VirusTotal, and monitoring for unexpected launch agents. Organizations should implement YARA rules (e.g., Jamf's public ruleset) and block C2 IPs using threat intelligence feeds. No specific patch exists as XCSSET exploits no unpatched vulnerabilities; user education and strict supply-chain controls remain the primary mitigations.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.