Microsoft warns about new variant of modular macOS malware called XCSSET

Microsoft Threat Intelligence has issued a warning about a new variant of a modular macOS malware called XCSSET that infects Xcode projects and has enhanced features when compared to its earlier variant.

The tech giant warned that the latest malware is the first known variant since 2022 and that it can target users by infecting commonly used tools such as their digital wallets, the Notes app, and their system information/files. 

The latest XCSSET variant is harder to flag due to a randomised approach for generating the payloads that are used to infect Xcode projects, apart from incorporating Base64, per Microsoft.

In its statement, Microsoft Threat Intelligence stressed on the importance of checking project downloads and/or clones, and sourcing apps from safe sources. System-based defence services are also another option that users can explore.

“Microsoft Defender for Endpoint on Mac detects XCSSET, including this latest variant. Users must always inspect and verify any Xcode projects downloaded or cloned from repositories, as the malware usually spreads through infected projects. They should also only install apps from trusted sources, such as a software platform’s official app store,” posted Microsoft Threat Intelligence on X on February 17.