XCSSET evolves again: Analyzing the latest updates to XCSSET’s inventory

XCSSET evolves again: analysing the latest updates to XCSSET’s inventory, Microsoft Threat Intelligence reports a new variant in the wild that adds browser targeting, clipboard hijacking and enhanced persistence. The update describes a four‑stage infection chain, with the fourth stage introducing a boot() modification and multiple new modules that download and execute components, including an info‑stealer, a file‑stealer and several persistence mechanisms.

Notable changes include a LaunchDaemon‑based persistence module called xmyyeqjx, Git‑based persistence via jey, and an info‑stealer module that targets Firefox data, while a new submodule monitors the clipboard and can substitute wallet addresses from a downloaded configuration file. The analysis also notes run‑only compiled AppleScripts, encrypted and obfuscated code, and a tactic to masquerade as legitimate System Settings via a fake app to install the malicious payload.

Defenders are urged to inspect Xcode projects, patch systems promptly, and employ Defender for Endpoint protections and related mitigations, while Microsoft has coordinated with Apple and GitHub to take down affected repositories. According to Microsoft Threat Intelligence.