- Microsoft warns of new version of XCSSET InfoSteals
- It comes with new blur, infection and persist techniques
- It was seen in “limited” attacks in nature
A new variant of a well -known macOS malware makes rounds on the Internet targeting users through infected Xcode projects.
Researchers from Microsoft Threat Intelligence Team said the modular malware is seen in “limited attacks” at this time, but suggested that people still keep their guard up.
According to the researchers, this is the first upgrade to XCSSET in three years. It has now improved veiling methods, updated persistence mechanisms and new infection strategies.
Examine Xcode projects
“These improved features add to this malware family’s previously known options, such as targeting digital wallets, collecting data from the Notes app and exfiltrating system information and files,” Microsoft said.
Microsoft first reported this new XCSSET string in mid-February this year, and has now emerged with an in-depth analysis.
Xcode is Apple’s official integrated development environment (idea) for creating apps on macos, iOS, iPados, Watchos and Tvos. It includes a code editor, debugger, interface builder and tools for testing and implementing apps.
In essence, XCSSET is an infoTeal. It is capable of dragging system information and files, stealing digital wallet data and grabbing information from the Official Notes app.
For obscurity, XCSSET now uses a “significantly more randomized approach” to generate payloads to infect Xcode projects. When it comes to updated persistence mechanisms, the new variant uses two techniques: “ZSHRC” and “DOCK”. Finally, for infection, there are now new methods for where the payload is located in a target Xcode project.
“Users must always inspect and verify any Xcode projects that have been downloaded or cloned from warehouses, as malware usually spreads through infected projects,” the company concluded. “They also need to install only apps from trusted sources, such as a software platform’s official App Store.”
The in -depth analysis of malware and its modus operandi can be found here.
