New macOS XCSSET Variant Targets Firefox with Clipper and Persistence Module

Sep 26, 2025Ravie LakshmananMalware / Browser Safety

Cybersecurity researchers have found an up to date model of a identified Apple macOS malware referred to as XCSSET that has been noticed in restricted assaults.

“This new variant of XCSSET brings key modifications associated to browser focusing on, clipboard hijacking, and persistence mechanisms,” the Microsoft Menace Intelligence crew stated in a Thursday report.

“It employs refined encryption and obfuscation methods, makes use of run-only compiled AppleScripts for stealthy execution, and expands its information exfiltration capabilities to incorporate Firefox browser information. It additionally provides one other persistence mechanism by LaunchDaemon entries.”

XCSSET is the identify assigned to a classy modular malware that is designed to contaminate Xcode initiatives utilized by software program builders and unleash its malicious capabilities when it is being constructed. Precisely how the malware is distributed stays unclear, nevertheless it’s suspected that the propagation depends on the Xcode undertaking recordsdata being shared amongst builders constructing apps for macOS.

Earlier this March, Microsoft uncovered a number of enhancements to the malware, highlighting its improved error dealing with and using three totally different persistence methods to siphon delicate information from compromised hosts.

The most recent variant of XCSSET has been discovered to include a clipper sub-module that screens clipboard content material for particular common expression (aka regex) patterns matching numerous cryptocurrency wallets. Within the occasion of a match, the malware proceeds to substitute the pockets tackle within the clipboard with an attacker-controlled one to reroute transactions.

The Home windows maker additionally famous that the brand new iteration introduces modifications to the fourth stage of the an infection chain, notably the place an AppleScript utility is used to run a shell command to fetch the final-stage AppleScript that is chargeable for gathering system info and launching numerous sub-modules utilizing a boot() operate.

Notably, the modifications embrace additional checks for the Mozilla Firefox browser and an altered logic to find out the presence of the Telegram messaging app. Additionally noticed are modifications to the assorted modules, in addition to new modules that didn’t exist in earlier variations –

• vexyeqj, the data module beforehand referred to as seizecj, and which downloads a module referred to as bnk that is run utilizing osascript. The script defines features for information validation, encryption, decryption, fetching further information from command-and-control (C2) server, and logging. It additionally consists of the clipper performance.
• neq_cdyd_ilvcmwx, a module just like txzx_vostfdi that exfiltrates recordsdata to the C2 server
• xmyyeqjx, a module to arrange LaunchDaemon-based persistence
• jey, a module to arrange Git-based persistence
• iewmilh_cdyd, a module to steal information from Firefox utilizing a modified model of a publicly obtainable instrument named HackBrowserData

To mitigate the menace posed by XCSSET, customers are really useful to make sure that they preserve their system up-to-date, examine Xcode initiatives downloaded or cloned from repositories or different sources, and train warning relating to copying and pasting delicate information from the clipboard.