Xcode developers targeted through infected projects: Microsoft reported that XCSSET continues to spread via compromised Xcode projects, a technique that has been in use since the malware’s discovery in 2020. Once an infected project is cloned or downloaded, the malware can embed itself within the developer’s system and further propagate when the infected code is shared.”The new XCSSET variant introduces new methods for where the payload is placed in a target Xcode project,” Microsoft explained in the post. The malware selects from TARGET, RULE, or FORCED_STRATEGY methods to inject malicious code. Additionally, it can place payloads inside the TARGET_DEVICE_FAMILY key under build settings, allowing it to execute later in the development cycle.This attack method has proven particularly effective, as infected developers unknowingly distribute the malware when sharing their projects.Security researchers at Trend Micro previously described XCSSET’s distribution model as “clever,” noting that traditional verification methods such as checking file hashes are ineffective since developers themselves are unknowingly packaging the compromised files.
Growing macOS threat landscape and supply chain risks: Security experts warn that XCSSET’s evolution signals a growing threat to macOS, particularly through supply chain attacks that exploit trusted developer environments.”The latest variant of XCSSET is a clear sign that macOS threats are becoming more advanced, particularly targeting developers,” said Arjun Chauhan, Practice Director at Everest Group. “With its improved stealth tactics, stronger persistence methods, and better infection techniques, this version is harder to detect and remove.”Chauhan also pointed out that attackers are increasingly focusing on macOS, fueled by the rise of malware-as-a-service (MaaS). “The fact that XCSSET compromises Xcode projects is especially concerning because it enables a supply chain attack”, meaning the malware can spread beyond just the developer’s system to the end-users of infected apps,” he noted.”This shift indicates that cybercriminals are looking for high-impact entry points within Apple’s ecosystem, leveraging the trust that users place in developers,” Chauhan added. Security measures and Microsoft’s recommendations: Microsoft Defender for Endpoint on Mac can detect the new XCSSET variant, claimed the advisory, but developers and organizations are advised to take additional precautions.”Users must always inspect and verify any Xcode projects downloaded or cloned from repositories, as the malware usually spreads through infected projects,” Microsoft warned. The company also emphasized that applications should only be installed from trusted sources, such as official app stores, to mitigate risks.Security researchers have long observed XCSSET exploiting vulnerabilities in macOS to bypass Transparency, Consent, and Control (TCC) protections, enabling it to record screens, steal credentials, and access sensitive data from applications like Telegram, Chrome, and Skype. With this latest update, Microsoft has warned that macOS threats are evolving rapidly, making proactive security measures essential. As attackers continue refining their methods, enterprises, and software developers are advised to prioritize threat detection, adopt endpoint security solutions, and enforce strict software verification practices to safeguard their environments against this growing macOS malware threat.
First seen on csoonline.com
Jump to article: www.csoonline.com/article/3826783/xcsset-macos-malware-reappears-with-new-attack-strategies-microsoft-sounds-alarm.html
