New Malware Can Steal Crypto on Apple macOS Devices: Microsoft

If you’re on an Apple macOS device right now, you might want to keep reading.

Researchers from Microsoft Threat Intelligence have uncovered a new variant of malware that can target crypto wallets.

XCSSET was first detected back in 2020—and allows malicious actors to take screenshots, record what users are doing, and steal data from Telegram.

This updated version can also target data in Apple’s Notes app, and uses obfuscation techniques that make the malware harder to detect.

Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that targets users by infecting Xcode projects, in the wild. While we’re only seeing this new XCSSET variant in limited attacks at this time, we’re sharing this information… pic.twitter.com/oWfsIKxBzB

— Microsoft Threat Intelligence (@MsftSecIntel) February 17, 2025

Enhanced persistence mechanisms mean the malicious payload is deployed every time the Launchpad is activated from the macOS dock.

DOWNLOAD HERE

And given it has the capability of encrypting files, there’s a real risk of XCSSET being used for ransomware attacks.

Microsoft says the latest variant has only been detected in “limited attacks” so far, and was sharing this information to help organizations protect themselves.

When the XCSSET malware first emerged, researchers at Trend Micro said it primarily appeared to target developers.

Even back then, XCSSET had the theoretical capability to manipulate what the end user sees on their browser. This could include modifying or replacing Bitcoin and other crypto addresses, meaning funds aren’t sent to their desired destination.

It tends to be disseminated through infected Xcode projects, which consist of the files used to create apps for macOS.

The researchers added that Microsoft Defender for Endpoint on Mac has the capability to detect this latest variant of XCSSET.

The researchers added that users “must always inspect and verify any Xcode projects downloaded or cloned from repositories, as the malware usually spreads through infected projects. They should also only install apps from trusted sources, such as a software platform’s official app store.”

The evolving ransomware space

Chainalysis recently noted that the ransomware space is rapidly evolving, with payments to hackers falling 35% in 2024 compared with the year before. Increased action from law enforcement and a “growing refusal by victims to pay” were some of the key factors behind the drop.

But the blockchain intelligence firm went on to warn that attackers are starting to shift their tactics by deploying new ransomware strains, and starting to ask for payments just hours after data is encrypted.