Microsoft Threat Intelligence has uncovered a critical evolution in the XCSSET macOS malware family, revealing a sophisticated dual persistence mechanism that allows the threat to survive system reboots and evade traditional security tools. The discovery, made on February 17, 2025, represents the most significant update to this five-year-old malware family since 2022, with cryptocurrency wallets firmly in the crosshairs.
The Exploit Mechanics
What sets this XCSSET variant apart is its innovative approach to maintaining a foothold on infected systems. The malware deploys two independent persistence strategies, ensuring that even if one is discovered and removed, the other continues to function. The first technique targets the Zsh shell environment by creating a hidden payload file at ~/.zshrc_aliases and appending execution commands to the standard ~/.zshrc configuration file. Every time the user opens a terminal session, the malware silently reactivates.
The second persistence method is considerably more devious. The malware downloads a cryptographically signed copy of dockutil, a legitimate macOS dock management tool, from its command-and-control infrastructure. It then creates a malicious Launchpad application containing the payload and modifies the system dock to point to this fake application. When a user clicks Launchpad, both the genuine interface and the malicious payload execute simultaneously, with no visible indication that anything is amiss.
The obfuscation layer has also been upgraded significantly. The malware now uses alternating Base64 and xxd hexdump encoding with varying iteration depths, making reverse engineering considerably more time-consuming. Module names within the code are similarly obfuscated, preventing analysts from understanding component purposes without deep disassembly.
Affected Systems
The primary infection vector remains compromised Xcode projects distributed through unofficial repositories. Developers who clone and build these tainted projects inadvertently execute the payload. Once active, the malware systematically targets cryptocurrency wallet data, browser credentials, Notes application content, and chat application databases. With Bitcoin trading at approximately $95,773 and Ethereum around $2,743 at the time of the discovery, cryptocurrency wallets represent high-value targets for the operators behind this campaign.
The new Xcode infection methods are particularly concerning for the developer community. The malware now leverages the TARGET, RULE, and FORCED_STRATEGY build configuration options to embed its payload, and can insert malicious code into the TARGET_DEVICE_FAMILY key within project build settings. This code executes during the build process, meaning that simply opening an infected project in Xcode can trigger the infection chain.
The Mitigation Strategy
Organizations with macOS development environments should implement multi-layered defenses. First, all Xcode projects sourced from external repositories must undergo automated security scanning before being built on production machines. Second, system administrators should regularly audit shell configuration files and dock configurations for unauthorized modifications. Endpoint detection and response platforms should be configured to flag suspicious dockutil activity and unexpected Zsh profile changes.
For individual cryptocurrency users on macOS, the most effective protection is moving significant holdings to hardware wallets that are immune to software-based data exfiltration. Software wallets, regardless of their encryption, remain vulnerable to malware that can capture keys, seed phrases, or transaction signing requests in real time.
Lessons Learned
The evolution of XCSSET over five years demonstrates the sustained investment that threat actors are willing to make in macOS-specific attack tools. The previous version of this malware exploited a genuine zero-day vulnerability in macOS, patched by Apple in May 2021, which speaks to the technical sophistication of its developers. The fact that this update arrives three years after the last significant variant suggests a patient, long-term development cycle rather than opportunistic modifications.
The dual persistence approach is particularly instructive for security defenders. Many malware removal guides focus on eliminating a single persistence vector, which in this case would leave the system vulnerable to reinfection through the backup mechanism. Comprehensive incident response requires checking all possible persistence locations simultaneously.
User Action Required
macOS users who develop software or hold cryptocurrency should immediately check their systems for signs of compromise. Examine the contents of ~/.zshrc for references to ~/.zshrc_aliases or other unexpected inclusions. Verify that all dock applications point to legitimate system paths rather than custom Launchpad entries. Developers should audit their Xcode project build settings for suspicious entries in TARGET, RULE, FORCED_STRATEGY, and TARGET_DEVICE_FAMILY configurations. When in doubt, rebuild development environments from clean images.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always consult with qualified professionals for specific security concerns.
five years of updates on a malware family targeting crypto wallets on mac. the ROI on draining metamask extensions must be insane to justify that kind of dev time
the fact that a 5 year old malware family keeps getting updates tells you the margins on wallet drainer operations are insane. full time dev team salaries paid for by stolen seed phrases
signed dockutil bypassing notarization is the real story. apple built a trust system and the malware just uses a valid cert to walk right through the front door
cert_pin_ apple built notarization as a trust layer and malware just uses valid certs. the entire security model assumes signed equals safe
cert_pin_ apple notarization was supposed to prevent exactly this. a signed dockutil copy walking through the front door means the trust model is fundamentally broken for crypto users
crypto wallets on mac are a sitting duck for this. metamask, phantom, solflare, all sitting there as browser extensions. one persistence mechanism and they can wait months before draining
the dockutil trick is honestly clever. signed binary from a legit tool, most endpoint agents would whitelist that without a second thought
the dockutil trick is the scary part. signed binary so macOS notarization gives it a free pass. most EDR tools wont flag it
kernel_panic_ the dockutil trick works because macOS explicitly trusts signed binaries. apple notarization is supposed to prevent this but the cert was valid
kernel_panic_ the dockutil trick works because macOS trusts signed binaries. Apple notarization is supposed to prevent this but the cert was valid. endpoint agents whitelist signed binaries by default
dual persistence through .zshrc is nasty. even if you clean the dock entry you’d never think to check your shell config unless you’re specifically looking
Raj Patel checking .zshrc is good advice but who actually does that regularly. dual persistence means youd need to clean both vectors simultaneously
Raj Patel is right about .zshrc being overlooked. most mac users have never even opened their shell config. the dual persistence means even a wipe might miss one vector
malware_hunter most mac users dont even know what .zshrc is let alone check it. dual persistence on a consumer OS is basically invisible
Alejandro R. dual persistence through shell config and dockutil means even wiping macOS wont help if you restore from backup. the payload survives in iCloud keychain syncs too
zsh_patrol_ iCloud keychain sync being the reinfection vector is dark. you wipe your mac, restore settings, and the payload comes right back. apple designed the perfect malware distribution channel
Buse E. iCloud keychain reinfection vector means the only real fix is nuking the keychain entirely. most people would rather risk losing their wallets than re-enter 200 passwords
zsh_forensics_ the iCloud keychain sync angle is terrifying. payload survives a full wipe because Apple pushes it back from the cloud. clean installs are no longer clean
Alejandro R. most mac users have never opened terminal let alone checked .zshrc. dual persistence through shell config plus dockutil means even a wipe might miss one vector. hardware wallet is the only real defense
five years old and still getting updates. whoever runs xcsset clearly has funding and a long term roadmap, which is terrifying
buff_satoshi five years of active development on a mac malware family targeting crypto wallets. these devs are funded and patient
five years of active development on a malware family targeting crypto wallets. buff_satoshi is right, these devs are funded and patient. this isnt some script kiddie side project
five years of dev time on macOS crypto malware means the returns from draining wallets exceed the cost of a full time dev team. that is the scariest ROI calculation in this space
Sunghee P. a full dev team funded by stolen seed phrases. the economics of crypto malware are darker than most people realize
five years of funded development on a mac wallet drainer. the ROI on stolen seed phrases must be competitive with legitimate SaaS revenue at this point