Microsoft uncovers new variant of XCSSET macOS malware in targeted attacks

Microsoft Threat Intelligence researchers have found a new version of the macOS malware XCSSET that has been used in limited attacks. According to Microsoft Threat Intelligence researchers, the variant can steal Firefox data and hijack the clipboard, and it avoids detection using encryption and obfuscation while running secret AppleScripts, with an additional persistence mechanism through LaunchDaemon entries.

The variant features a submodule designed to monitor the clipboard and references a downloaded configuration file containing address regex patterns associated with various digital wallets, and if a pattern match is detected, XCSSET can substitute the clipboard content with attacker wallet addresses.

It includes several new modules, including an info-stealer that exfiltrates data from Firefox, a RunMe function that downloads a Mach-O FAT binary for info stealing, and a modified HackBrowserData to export browser data such as passwords, history and cookies. The four-stage infection chain includes a fourth stage with a boot function to download and run submodules, and the malware uses run-only AppleScripts, AES-encrypted C2 configs, and clipboard hijacking for crypto fraud.

Microsoft also advises keeping OS and apps updated, inspecting Xcode projects, validating clipboard contents, and enabling Defender for Endpoint on Mac for detection and quarantine.