Advanced Cleaner Malaware Download Link So

Meanwhile, Intego informed Vultr that the XCSSET malware campaign had begun using their servers.

Among them, it can exploit zero-day vulnerabilities, hijack browsers, steal passwords, take screenshots, and exfiltrate data.

If an XCSSET-infected Xcode project is opened and built, malicious code will run on the developers Mac.

This means that you dont necessarily have to be a developerand you dont need to have Xcode installedto get infected.

An Xcode project infected by XCSSET can lead to malicious code being executed on a developers computer.

If a developers Mac is infected with XCSSET, the infection can spread to any Mac app the developer createswhich in a sense can make the developer an unknowing distributor of XCSSET malware.

If a developers users were to get infected, this would be a huge boon for the malware maker, because they would have many more computers to exploit, and they could leverage XCSSETs backdoor and browser hijacking capabilities to install other malware on infected systems.

This gives the attacker carte blanche; they can do essentially anything they want with your Safari browsing experience.

Advanced Cleaner Malaware Download Link So

A couple of interesting examples coded into the malware include: attempting to steal credit card data when a victim accesses the Apple Store, and replacing the Chrome download link so the victim will receive an older (and thus insecure) version.

Notably, as of the time of this writing, no transactions have occurred to the attackers Bitcoin or EthereumTether addresses since the malware campaign is believed to have started in June (the last transactions were in May), and the attackers Litecoin address seems to have never been used.

Perhaps this is of interest to the malware maker because many people store passwords or sensitive information in notes applications, or occasionally send messages of a confidential or private nature to loved ones, trusted friends, or colleagues via direct messaging services.

The vulnerability seems to be based on Phil Stokes research from September 2018, also detailed by Howard Oakley that November, into how macOS automatically grants Full Disk Access permission to Remote Login (ssh) when the feature is enabled.

Oakley has written a follow-up article regarding the vulnerabilitys use in XCSSET.

He also explains how users can manually mitigate the vulnerability, in case Apple continues to leave it unpatched (Apple has already ignored it for nearly two years).

By deleting the Safari Session State Key, and re-adding it while invoking the non-sandboxed development version of Safari, XCSSET can evidently run privileged malicious code without authorization from the victim.

Throwing away a potential opportunity to profit from reporting a vulnerability often indicates that the attackers primary motivation may not be financial.

And if the main motivation isnt making money, this is often a sign that the attacker may be a nation-state threat actor (or may be sponsored by one).

It is currently unclear whether that is the case with XCSSET, however.

Furthermore, by mid-August at least 380 victim IP addresses had been collected by the threat actor that distributed the malware.

Moreover, assuming that many of the victims are developers who make and distribute Mac apps, even numbers in the hundreds should be rather concerning given that their apps may unintentionally spread XCSSET malware to their end-users.

Many zip-compressed Xcode projects were first uploaded to VirusTotal on June 20.

This suggests at least two possibilities: perhaps the malware maker may have been testing to see whether the projects would be detected, or perhaps many victims had downloaded infected Xcode projects on the same date and all decided to scan them for known malware.

An IP address (46.101.126.33) to which the malware communicated until August 20 was within a block of IP addresses owned by DigitalOcean.

We observed that all three domains began to be hosted at a Vultur IP address (95.179.160.42) instead.

Advanced Mac Cleaner Malaware