Hackers Deploy Sophisticated macOS Malware to Steal Cryptocurrency

Security researchers have uncovered a new variant of the XCSSET malware targeting macOS users, with advanced capabilities designed to steal cryptocurrency and sensitive data while evading detection.

 

Evolving Threat

Microsoft’s threat intelligence team reported on Monday that they had identified this updated strain in limited attacks. XCSSET, originally discovered in August 2020, spreads through infected Xcode projects—Apple’s development environment for creating macOS and iOS applications.

 

The new variant introduces enhanced stealth techniques, allowing it to persist on infected devices and spread more efficiently. It continues to target cryptocurrency wallets, extract Notes app data, and exfiltrate system files.

Microsoft urged developers to carefully inspect any Xcode projects downloaded from third-party repositories and to install software only from trusted sources, such as official app stores.

 

Wider Cryptocurrency Attacks

The discovery comes amid a broader wave of malware campaigns aimed at cryptocurrency and fintech firms.

 

• Zhong Stealer, detected in December, has been used to target fintech companies, with hackers posing as customers on platforms like Zendesk to trick support agents into installing malware. It steals login credentials, browser data, and extension information, with exfiltrated data sent to servers in Hong Kong.
• Slovenia’s cybersecurity agency also identified BeaverTail and InvisibleFerret, malware strains aimed at Web3 firms involved in blockchain, smart contracts, and cryptocurrency.

While no specific hacker group has been linked to these attacks, previous research has associated similar campaigns with state-sponsored North Korean cyber operations.

 

Cybersecurity experts advise organisations in cryptocurrency and fintech to implement strong endpoint security, monitor unusual network activity, and train employees to detect social engineering attacks.