New XCSSET macOS Malware Variant Hijacks Cryptocurrency Transactions

According to Microsoft, a new variant of the XCSSET macOS malware now monitors the system clipboard to hijack cryptocurrency transactions, adding a four-stage infection chain, an extra persistence mechanism and updated browser targeting.

The fourth stage fetches a run-only AppleScript that includes data validation, encryption, decryption and additional data collection from the command-and-control server, with the script also containing clipboard monitoring functions to identify cryptocurrency addresses and replace them with attacker-controlled addresses.

The campaign also involved retrieving from the C&C another exfiltration script and establishing LaunchDaemon persistence by placing a payload file in the user’s home directory, while the malware alters system configurations to disable certain macOS security updates and the Rapid Security Response mechanism. It also creates a fake System Settings application to masquerade as legitimate when the legitimate app is launched.

The variant further expands to an info-stealer module targeting Firefox, stealing history, cookies, stored passwords and credit card information. Written by Ionut Arghire, 26 September 2025.