PSA – Malware spreading via Xcode project.pbxproj files

If you build Xcode your project that has `TARGET_DEVICE_FAMILY` with a suspicious Base64 encoded string in your pbxproj file, it will install malware onto your computer in your ~/.zshrc_aliases and ~/.zshrc. Perhaps it can infect in other ways. This triggers a series of requests that downloads and runs arbitrary shell scripts.

Some things the shell script does:

Steal and upload Google Chrome cookies. Also, prevents Google Chrome from updating. Also infects Safari, perhaps other browsers too. No sure what it does for other browsers though.

Copy and upload all your notes from the notes app.

Capture and upload user name, serial number, list of all installed application and launch scripts, version numbers of software, etc.

Infect other apps like Telegram.

Take over Launchpad.app

..probably endlessly more things

This malware seems to then update all pbxproj files on your computer to include the malware. Once this gets checked in, and others build the project, it continues to spread.

Some findings by Microsoft (copied tweet) https://x.com/MsftSecIntel/status/1891410993265123662

Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that targets users by infecting Xcode projects, in the wild. While we’re only seeing this new XCSSET variant in limited attacks at this time, we’re sharing this information so users and organizations can protect themselves against this threat.

Its first known variant since 2022, this latest XCSSET malware features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies. These enhanced features add to this malware family’s previously known capabilities, like targeting digital wallets, collecting data from the Notes app, and exfiltrating system information and files.

Enhanced obfuscation methods: The new XCSSET variant uses a significantly more randomized approach for generating payloads to infect Xcode projects. Both its encoding technique and number of encoding iterations are randomized. In addition, while older XCSSET variants only used xxd (hexdump) for encoding, the latest one also incorporates Base64. At its code level, the variant’s module names are also obfuscated, making it more challenging to determine the modules’ intent.

Updated persistence mechanisms: The new XCSSET variant employs two distinct techniques: the “zshrc” method and the “dock” method. In the zshrc method, the malware creates a file named ~/.zshrc_aliases, which contains the payload. It then appends a command in the ~/.zshrc file to ensure that the created file is launched every time a new shell session is initiated, guaranteeing the malware's persistence across shell sessions.

On the other hand, the dock method involves downloading a signed dockutil tool from a command-and-control server to manage the dock items. The malware then creates a fake Launchpad application and replaces the legitimate Launchpad’s path entry in the dock with this fake one. This ensures that every time the Launchpad is started from the dock, both the legitimate Launchpad and the malicious payload are executed.

New infection techniques: The new XCSSET variant introduces new methods for where the payload is placed in a target Xcode project. The method is chosen from one of the following options: TARGET, RULE, or FORCED_STRATEGY. An additional method involves placing the payload inside the TARGET_DEVICE_FAMILY key under build settings and running it at a latter phase.

Microsoft Defender for Endpoint on Mac detects XCSSET, including this latest variant. Users must always inspect and verify any Xcode projects downloaded or cloned from repositories, as the malware usually spreads through infected projects. They should also only install apps from trusted sources, such as a software platform’s official app store.

Learn more about Defender for Endpoint on Mac: https://msft.it/6018UQysY