XCSSET macOS Malware Evolves: New Variant Targets Firefox, Hijacks Clipboard for Crypto Theft

Microsoft Threat Intelligence has identified a new variant of XCSSET, the macOS malware long targeting software developers through malicious Xcode project infections, with expanded functionality and persistence upgrades. The latest variant adds modules for browser data theft, including Firefox, using a modified HackBrowserData project to exfiltrate passwords, cookies, credit card details and history.

It also introduces clipboard hijacking for crypto theft, with a submodule that monitors the clipboard and can replace copied wallet addresses with attacker-controlled ones after matching against a downloaded configuration file. Persistence has been upgraded via a LaunchDaemon-based module that can disable Apple's Rapid Security Response updates while masquerading as a fake System Settings[.]app.

The malware employs sophisticated encryption and obfuscation techniques and run-only compiled AppleScripts for stealthy execution, and the first three stages mirror earlier variants while the new fourth stage adds heavily upgraded capabilities. Attacks remain limited in scope, but the campaign appears targeted at macOS developers and users in the cryptocurrency and tech sectors, with Apple and GitHub collaborating to take down repositories hosting malicious Xcode projects. 29 September 2025.