New macOS XCSSET Variant Targets Firefox with Clipper and Persistence Module

Cybersecurity researchers have spotted an updated variant of the Apple macOS malware XCSSET, observed in limited attacks since 26 September 2025. According to a Microsoft Threat Intelligence report, the new variant alters browser targeting, introduces a clipper sub-module to monitor clipboard content for cryptocurrency wallets, and expands its data exfiltration to Firefox data while adding a new LaunchDaemon-based persistence mechanism.

It employs run-only compiled AppleScripts for stealthy execution and, if a match is found in the clipboard, replaces the wallet address with an attacker-controlled one. The latest version also revises the fourth stage of the infection chain, using an AppleScript application to run a shell command that fetches the final-stage AppleScript responsible for collecting system information and launching sub-modules.

Researchers detail new modules with names such as vexyeqj, neq_cdyd_ilvcmwx, xmyyeqjx, jey, and iewmilh_cdyd, including a Firefox data theft component that borrows functionality from HackBrowserData. To mitigate the threat, users are advised to keep systems up-to-date, scrutinise Xcode projects from repositories, and be cautious when copying and pasting sensitive data from the clipboard.