XCSSETMalware
- osx.dubrobber
XCSSET is a modular macOS malware family delivered through infected Xcode projects and executed when the project is compiled. Active since August 2020, it has been observed installing backdoors, spoofed browsers, collecting data, and encrypting user files.From MITRE ATT&CK
Last reported 18 months ago, by Huntress4 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1036Masquerading
“Still, this development helps crack down on macOS malware that tries to bypass TCC through bombarding users with TCC prompts or masquerading as legitimate software.”
- T1543.001Launch Agent
“…ng Launch Daemons, which are property list files (plist) on various locations on the disk that are executed at the system level, and Launch Agents, which require a user session and execute specific binaries from plists.”
- T1543.003Windows Service
“That means that instead of using Windows services or the registry for persistence, macOS malware will instead use different processes.”
- T1543.004Launch Daemon
“These have most typically been Launch Items in macOS, including Launch Daemons, which are property list files (plist) on various locations on the disk that are executed at the system level, and Launch Agents, which require a user session and execute specific binaries from plists.”
- T1564.014Extended Attributes
“If we run xattr <path_to_application> from our command line, it will list out the extended attributes.”
- T1684Social Engineering
“This could lead to lateral movement across the network, higher chances for future social engineering attacks, spying on users, etc.”
What the reports say
4 reports, newest first · the exact sentence from each-
Say Hello to Mac Malware“XCSSET, which is macOS malware that was uncovered a few years ago and has various capabilities (from stealing victims’ app information to taking screenshots) was previously found exploiting CVE-2021-30713, a vulnerability allowing threat actors to bypass the TCC framework, for in…”
-
Ask the Mac Guy: What's the Deal with Full Disk Access for Mac?“We’ve seen TCC bypassed by some sophisticated malware like XCSSET, where malware was able to piggyback on other TCC permissions.”
-
Ask the Mac Guy: macOS Security Myths“We've seen with the XCSSET malware that threat actors can actually target programs in the macOS ecosystem, as well as (ab)use the TCC database.”
-
Built-in macOS Security Tools“…tor substantially different, is where MRT scans on reboot and login, XProtect Remediator scans on a regular cadence, with a scan for the XCSSET (OSX.DUBROBBER) malware running the most frequently - every hour or two.”
Indicators in its reports
named in the reports above- mrt[.]appin 1 report
Copy this indicator · defanged
Thanks — we review every report.