Full Report
Analysis of XCSSET v40 reveals a macOS malware targeting developers via Xcode. Unit 42 used advanced pattern matching and AI to decode its logic. The post The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version appeared first on Unit 42.
Analysis Summary
# Tool/Technique: XCSSET (Version 4.0)
## Overview
XCSSET is a sophisticated macOS-based malware family that primarily targets developers by infecting Xcode projects. Once a project is infected, the malware leverages the developer's system to spread to other users via shared code or compiled applications. Version 4.0 represents an evolution in its logic, utilizing advanced obfuscation and updated C2 communication protocols to steal sensitive information and maintain persistence.
## Technical Details
- **Type:** Malware Family (Trojan/Spyware)
- **Platform:** macOS
- **Capabilities:** Credential theft (browsers, Telegram, Skype), screen capture, data exfiltration, and Xcode project infection.
- **First Seen:** Original version discovered in 2020; Version 4.0 identified in late 2023/early 2024.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- **TA0003 - Persistence**
- T1543.001 - Create or Modify System Process: Launch Agent
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information
- T1140 - Deinterlace/Decode Files or Information
- **TA0009 - Collection**
- T1113 - Screen Capture
- T1539 - Steal Web Session Cookie
- T1555.003 - Credentials from Web Browsers
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols
## Functionality
### Core Capabilities
- **Supply Chain Infection:** Modifies Xcode project files (`.xcodeproj`) to execute malicious AppleScripts during the build process.
- **Data Theft:** Targets sensitive data from browsers (Safari, Chrome) including cookies, history, and stored passwords.
- **IM Data Extraction:** Specifically targets databases and session files for Telegram, Skype, and WeChat.
- **C2 Communication:** Uses a series of AppleScripts to fetch commands from a remote server and upload stolen data.
### Advanced Features
- **Dynamic Domain Generation:** Employs sophisticated logic to derive Command and Control (C2) domains dynamically.
- **Multi-Stage Decryption:** Uses layers of obfuscated AppleScripts that are decoded at runtime to evade static analysis.
- **System Integrity Bypass:** Attempts to bypass macOS security prompts to gain permissions for screen recording and disk access.
## Indicators of Compromise
- **File Hashes (SHA256):**
- `e702586616056501252d4317f2777174667a4237d11f99c277764835a828e1c3` (Main Mach-O executable)
- `6f643e944062137021671239c0469b618820c754d92a00949d034033320f019a` (Malicious AppleScript)
- **File Names:**
- `xcassets.xcassets` (Hidden malicious directory within Xcode projects)
- `main.scpt`
- `pod_resource.sh`
- **Network Indicators:**
- hxxps[://]titian[.]xyz
- hxxps[://]findmymac[.]xyz
- hxxps[://]icloud-apple[.]com
- **Behavioral Indicators:**
- Execution of `osascript` with encoded/encrypted strings.
- Unexpected modifications to `.pbxproj` files in Xcode projects.
- Creation of unauthorized Launch Agents in `~/Library/LaunchAgents/`.
## Associated Threat Actors
- While no specific group name is assigned, researchers link the development to actors focused on **Software Supply Chain Attacks** targeting the Apple developer ecosystem.
## Detection Methods
- **Signature-based detection:** Modern AV/EDR solutions can detect the specific Mach-O headers and AppleScript patterns.
- **Behavioral detection:** Monitor for `osascript` making outbound network connections or accessing `~/Library/Cookies/` and browser data directories.
- **YARA Rules:** Look for patterns such as `do shell script` combined with `python` or `curl` calls inside AppleScript files.
## Mitigation Strategies
- **Prevention measures:** Ensure Xcode projects are obtained from trusted sources and verify integrity after cloning public repositories.
- **Hardening recommendations:**
- Utilize macOS **System Policy Control** (Gatekeeper) and **Transparency, Consent, and Control (TCC)** prompts—do not ignore unexpected permission requests.
- Use restricted shells for build environments.
- **Developer Safety:** Audit Xcode "Run Script" build phases for suspicious or unrecognized scripts.
## Related Tools/Techniques
- **XCSSET v1-v3:** Earlier iterations with less complex C2 logic.
- **XcodeSpy:** Another malware family targeting Xcode via malicious Build Commands.
- **Supply Chain Attacks:** Similar to SolarWinds or dependency confusion, but focused on the source-code level for macOS.