MITRE ATT&CKsoftware (malware)

S0658 XCSSET

Published 2021-10-05 Modified 2025-04-04 Official page ↗
Domain
enterprise
Platforms
macOS
Aliases
OSX.DubRobber
Version
1.3
Created
2021-10-05

Description

XCSSET is a modular macOS malware family delivered through infected Xcode projects and executed when the project is compiled. Active since August 2020, it has been observed installing backdoors, spoofed browsers, collecting data, and encrypting user files. It is composed of SHC-compiled shell scripts and run-only AppleScripts, often hiding in apps that mimic system tools (such as Xcode, Mail, or Notes) or use familiar icons (like Launchpad) to avoid detection.

Related

Uses · MITRE ATT&CK (33)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1548.006 TCC Manipulation sub-technique
  • T1647 Plist File Modification technique
  • T1614.001 System Language Discovery sub-technique
  • T1098.004 SSH Authorized Keys sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1574.006 Dynamic Linker Hijacking sub-technique
  • T1195.001 Compromise Software Dependencies and Development Tools sub-technique
  • T1569.001 Launchctl sub-technique
  • T1059.004 Unix Shell sub-technique
  • T1497.003 Time Based Checks sub-technique
  • T1564.001 Hidden Files and Directories sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1560 Archive Collected Data technique
  • T1056.002 GUI Input Capture sub-technique
  • T1554 Compromise Host Software Binary technique
  • T1553.001 Gatekeeper Bypass sub-technique
  • T1222.002 Linux and Mac Permissions sub-technique
  • T1546.004 Unix Shell Configuration Modification sub-technique
  • T1546 Event Triggered Execution technique
  • T1543.004 Launch Daemon sub-technique
  • T1539 Steal Web Session Cookie technique
  • T1518 Software Discovery technique
  • T1486 Data Encrypted for Impact technique
  • T1005 Data from Local System technique
  • T1036 Masquerading technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1068 Exploitation for Privilege Escalation technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
Show all 33 ›

References