Inside the XCSSET Dock Hijack: How macOS Malware Targets Crypto Wallets Through Your Dock

Microsoft Threat Intelligence has uncovered a critical evolution in the XCSSET macOS malware family, revealing a sophisticated dual persistence mechanism that allows the threat to survive system reboots and evade traditional security tools. The discovery, made on February 17, 2025, represents the most significant update to this five-year-old malware family since 2022, with cryptocurrency wallets firmly in the crosshairs.

The Exploit Mechanics

What sets this XCSSET variant apart is its innovative approach to maintaining a foothold on infected systems. The malware deploys two independent persistence strategies, ensuring that even if one is discovered and removed, the other continues to function. The first technique targets the Zsh shell environment by creating a hidden payload file at ~/.zshrc_aliases and appending execution commands to the standard ~/.zshrc configuration file. Every time the user opens a terminal session, the malware silently reactivates.

The second persistence method is considerably more devious. The malware downloads a cryptographically signed copy of dockutil, a legitimate macOS dock management tool, from its command-and-control infrastructure. It then creates a malicious Launchpad application containing the payload and modifies the system dock to point to this fake application. When a user clicks Launchpad, both the genuine interface and the malicious payload execute simultaneously, with no visible indication that anything is amiss.

The obfuscation layer has also been upgraded significantly. The malware now uses alternating Base64 and xxd hexdump encoding with varying iteration depths, making reverse engineering considerably more time-consuming. Module names within the code are similarly obfuscated, preventing analysts from understanding component purposes without deep disassembly.

Affected Systems

The primary infection vector remains compromised Xcode projects distributed through unofficial repositories. Developers who clone and build these tainted projects inadvertently execute the payload. Once active, the malware systematically targets cryptocurrency wallet data, browser credentials, Notes application content, and chat application databases. With Bitcoin trading at approximately $95,773 and Ethereum around $2,743 at the time of the discovery, cryptocurrency wallets represent high-value targets for the operators behind this campaign.

The new Xcode infection methods are particularly concerning for the developer community. The malware now leverages the TARGET, RULE, and FORCED_STRATEGY build configuration options to embed its payload, and can insert malicious code into the TARGET_DEVICE_FAMILY key within project build settings. This code executes during the build process, meaning that simply opening an infected project in Xcode can trigger the infection chain.

The Mitigation Strategy

Organizations with macOS development environments should implement multi-layered defenses. First, all Xcode projects sourced from external repositories must undergo automated security scanning before being built on production machines. Second, system administrators should regularly audit shell configuration files and dock configurations for unauthorized modifications. Endpoint detection and response platforms should be configured to flag suspicious dockutil activity and unexpected Zsh profile changes.

For individual cryptocurrency users on macOS, the most effective protection is moving significant holdings to hardware wallets that are immune to software-based data exfiltration. Software wallets, regardless of their encryption, remain vulnerable to malware that can capture keys, seed phrases, or transaction signing requests in real time.

Lessons Learned

The evolution of XCSSET over five years demonstrates the sustained investment that threat actors are willing to make in macOS-specific attack tools. The previous version of this malware exploited a genuine zero-day vulnerability in macOS, patched by Apple in May 2021, which speaks to the technical sophistication of its developers. The fact that this update arrives three years after the last significant variant suggests a patient, long-term development cycle rather than opportunistic modifications.

The dual persistence approach is particularly instructive for security defenders. Many malware removal guides focus on eliminating a single persistence vector, which in this case would leave the system vulnerable to reinfection through the backup mechanism. Comprehensive incident response requires checking all possible persistence locations simultaneously.

User Action Required

macOS users who develop software or hold cryptocurrency should immediately check their systems for signs of compromise. Examine the contents of ~/.zshrc for references to ~/.zshrc_aliases or other unexpected inclusions. Verify that all dock applications point to legitimate system paths rather than custom Launchpad entries. Developers should audit their Xcode project build settings for suspicious entries in TARGET, RULE, FORCED_STRATEGY, and TARGET_DEVICE_FAMILY configurations. When in doubt, rebuild development environments from clean images.

Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. Always consult with qualified professionals for specific security concerns.