The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version

MITRE Techniques

• [T1055 ] Process Injection – The malware loads core logic into memory and pivots through legitimate processes to stay hidden (‘the third stage includes a temporary staging applet that is dropped onto the system to load the final stage into volatile memory space’).
• [T1027 ] Obfuscated Files or Information – XCSSET v40 conceals functions, strings, and payloads with layered encryption and ciphers (‘the author used a multi-layered cipher shift to conceal the threat’s internal functions’).
• [T1105 ] Ingress Tool Transfer – It downloads modules and payloads from C2 endpoints for staged execution (‘downloads further modules’).
• [T1053 ] Scheduled Task/Job – The malware uses persistence mechanisms such as Launch Daemons and recurring re-infection behavior (‘persistent browser hijacking’, ‘usual persistence through Git hooks, Launch Daemons’).
• [T1547 ] Boot or Logon Autostart Execution – It persists through Launch Daemons, .zshrc, and trojanized applications to re-launch automatically (‘usual persistence through Git hooks, Launch Daemons and trojanized applications’).
• [T1219 ] Remote Access Software – The Chrome hijacking backdoor leverages CDP and remote payloads to control the browser (‘connects to the opened CDP port’).
• [T1056 ] Input Capture – Modules intercept credentials, password-manager autofill, and clipboard-related data (‘Credential theft’, ‘clipboard hijackers’).
• [T1114 ] Email Collection – Not mentioned directly; omitted.
• [T1557 ] Adversary-in-the-Middle – Traffic interception hooks on browser APIs capture sensitive streams and tokens (‘Hooks placed on window.fetch and XMLHttpRequest monitor to exfiltrate sensitive data streams’).
• [T1056.001 ] Keylogging – The malware includes keyboard hijacker functionality (‘clipboard_v2’, ‘payloader … performs keyboard hijacking’).
• [T1106 ] Native API – It invokes shell execution and system commands through local APIs (‘passes the remaining payload to the host’s underlying shell handler (exec.Command)’).
• [T1562.001 ] Disable or Modify Tools – It disables update, telemetry, and security mechanisms (‘prevents the endpoint from automatically retrieving updates’, ‘hinders the endpoint’s ability to send security-related data’).
• [T1497 ] Virtualization/Sandbox Evasion – The stats module checks hardware metadata and stops delivery on VMs (‘Hosts reporting a virtual environment receive no further module deliveries’).
• [T1071.001 ] Web Protocols – The malware uses WebSocket, HTTP GET, and POST for C2 communications (‘establishes a persistent WebSocket connection to the C2 server’).
• [T1132.001 ] Data Encoding – It uses Base64 and AES-encrypted blobs for transport and storage (‘Base64-encoded staging payload’).
• [T1021.005 ] VNC – Not mentioned directly; omitted.
• [T1095 ] Non-Application Layer Protocol – The C2 uses WebSocket for interactive payload delivery (‘persistent WebSocket connection to the C2 server’).
• [T1555 ] Credentials from Password Stores – It captures autofill and browser cookie tokens (‘extract cookie tokens invisibly’).
• [T1113 ] Screen Capture – Not mentioned directly; omitted.
• [T1587.001 ] Develop Capabilities: Malware – The operators refined and expanded XCSSET v40 with new modules and polymorphic infrastructure (‘actively refining XCSSET v40 after it was already deployed in the wild’).