MICROSOFT UNCOVERS NEW VARIANT OF XCSSET MACOS MALWARE IN TARGETED ATTACKS

Summary from the TLDR InfoSec newsletter

Microsoft has discovered a new XCSSET macOS malware variant being used in targeted attacks. It builds on the 2020 threat with advanced features, including stealing Firefox credentials via a modified HackBrowserData, hijacking cryptocurrency clipboard addresses using regular expressions, and increasing persistence through LaunchDaemon entries with AppleScripts and AES-encrypted C2 configurations. The four-stage infection chain uses modular payloads for info theft (vexyeqj/bnk), file exfiltration (neq_cdyd_ilvcmwx), persistence (xmyyeqjx creates fake System Settings apps and disables updates), and browser data extraction (iewmilh_cdyd targets passwords, cookies, and credit cards in Firefox). Security teams should review Xcode projects before use, deploy Microsoft Defender on macOS with cloud protection and PUA blocking, verify clipboard content before pasting sensitive information, and monitor for malicious LaunchDaemon entries (e.g., com.google.plists) and unusual creation of the ~/.root folder.