New XCSSET Malware Variant Targets macOS App Developers

Security researchers have identified an advanced variant of XCSSET that targets macOS app developers by infecting Xcode projects during build, introducing new modules and evasion techniques. The variant expands data exfiltration to include Firefox browser data and adds browser-targeting capabilities, while the infection chain continues to rely on project files shared among developers.

It relies on run-only compiled AppleScripts for stealthy execution and adds LaunchDaemon entries to improve persistence, according to Microsoft Threat Intelligence. A notable feature is a clipboard monitoring submodule that searches for cryptocurrency wallet address patterns and replaces matches with attacker-controlled addresses, potentially enabling wallet hijacking.

The malware also decrypts configuration data with AES using a hardcoded key and downloads a Mach-O FAT binary to perform its info-stealing operations, with components such as iewmilh_cdyd for Firefox data and neq_cdyd_ilvcmwx for additional script retrieval. mitigations call for careful inspection of Xcode projects, vigilant clipboard handling, and enabling defender protections as part of a defence against this evolving threat. 26 September 2025