XCSSET Malware Updates with Python 3 to Target macOS Monterey Users

Summary:

The operators of the XCSSET macOS malware have upped the stakes by making iterative improvements that add support for macOS Monterey by upgrading its source code components to Python 3. The malware authors have changed from hiding the primary executable in a fake Xcode.app in the initial versions in 2020 to a fake Mail.app in 2021 and now to a fake Notes.app in 2022. XCSSET, first documented by Trend Micro in 2020, has many moving parts that allow it to harvest sensitive information from Apple Notes, WeChat, Skype, and Telegram; inject malicious JavaScript code into various websites; and dump cookies from Safari web browser.[emaillocker id="1283"]

One of the aspects of the attack is that deploying the malware within Xcode projects is seen as a method of propagation via GitHub repositories to further expand its reach. Besides leveraging AppleScripts, the malware also takes advantage of Python scripts for dropping fake application icons on the macOS Dock and stealing data from the pre-installed Notes app. The latest version of XCSSET is also notable for incorporating modifications to AppleScripts to account for Apple's removal of Python 2.7 from macOS 12.3 released on March 14, 2022, indicating that the authors are continually updating the malware to increase their chance of success. 

References:

The following reports contain further technical details:

https://thehackernews.com/2022/08/xcsset-malware-updates-with-python-3-to.html

https://www.sentinelone.com/blog/xcsset-malware-update-macos-threat-actors-prepare-for-life-without-python/