A new and more dangerous version of the XCSSET macOS malware has been discovered, and it’s aiming straight at Apple developers.
Quick Summary – TLDR:
- Microsoft has identified a new variant of XCSSET malware targeting macOS systems through infected Xcode projects.
- The malware steals browser data, cryptocurrency, and sensitive developer content.
- It uses advanced evasion tactics like encrypted communications and fake system apps.
- Developers are urged to inspect shared Xcode projects and update macOS regularly.
What Happened?
Microsoft Threat Intelligence has uncovered a sophisticated new strain of the XCSSET malware. This version enhances its ability to steal data and persist on macOS systems by exploiting the trust and collaboration among developers who share Xcode projects.
The malware executes when developers build infected projects, silently running in the background while stealing data, hijacking cryptocurrency transactions, and disabling security updates.
Microsoft Threat Intelligence has uncovered a new variant of the XCSSET malware, which is designed to infect Xcode projects, typically used by software developers building Apple or macOS-related applications. https://t.co/bEMKCzH861
— Microsoft Threat Intelligence (@MsftSecIntel) September 25, 2025
This new XCSSET variant improves browser…
Malware Targets macOS Developers via Xcode
XCSSET spreads by embedding malicious code into Xcode projects, which are widely used by Apple developers. Once a developer builds an infected project, the malware executes immediately.
Microsoft explained, “The XCSSET malware is designed to infect Xcode projects, typically used by software developers, and run while an Xcode project is being built.”
- Malware attaches to Xcode projects and spreads when developers unknowingly share code.
- Executes silently during project builds.
- Leverages trusted development environments to hide its activity.
Expanded Data Theft and Browser Targeting
The new variant extends its reach beyond Safari and Chrome. It now targets Firefox browser data using a modified version of HackBrowserData, a legitimate open-source tool that extracts passwords, cookies, credit card details, and browsing history.
- Firefox joins Safari and Chrome as targets for data exfiltration.
- Stolen data includes login credentials and saved personal info.
- This poses a serious threat to both personal and professional digital assets.
Clipboard Hijacking to Steal Cryptocurrency
A particularly harmful feature is the malware’s ability to monitor the clipboard for patterns that resemble cryptocurrency wallet addresses.
When detected, the malware replaces the copied address with one belonging to the attacker, tricking users into sending crypto funds to a fraudulent wallet.
- Detects and replaces copied wallet addresses using regex.
- Crypto transactions are silently redirected.
- Users could lose large sums without realizing it.
Stealth and Persistence Tactics
This variant of XCSSET goes beyond previous versions in its ability to remain hidden. It uses run-only compiled AppleScripts and AES encryption to evade traditional security scans and reverse engineering.
It also creates LaunchDaemon entries and fake apps like “System Settings.app” in temporary folders. These appear legitimate but act as backdoors, granting persistent access to the system.
- Uses hardcoded AES keys for secure communication with C2 servers.
- Disables Apple’s Rapid Security Response and update features.
- Communicates with suspicious domains disguised as content delivery networks.
What Developers Should Do?
Microsoft and cybersecurity experts strongly recommend the following actions:
- Inspect all Xcode projects, especially shared or downloaded ones, for hidden malicious code.
- Keep macOS and apps up to date to avoid unpatched vulnerabilities.
- Use tools like Microsoft Defender for Endpoint on Mac for behavioral detection.
- Verify clipboard contents before pasting sensitive data like wallet addresses.
SQ Magazine’s Takeaway
If you’re an Apple developer, this malware should be on your radar. As someone who writes and shares code regularly, I know how easy it is to trust a shared project without checking every detail. But that trust is exactly what this malware exploits. The idea that just building a project could secretly install a backdoor or reroute crypto funds is terrifying. Stay vigilant, verify your tools, and update everything. This isn’t just a warning for big companies. It’s a wake-up call for every solo dev working on a Mac.
