Security News > 2021 > July > MacOS malware steals Telegram accounts, Google Chrome data
Security researchers have published details about the method used by a strain of macOS malware to steal login information from multiple apps, enabling its operators to steal accounts.
Dubbed XCSSET, the malware keeps evolving and has been targeting macOS developers for more than a year by infecting local Xcode projects.
XCSSET can steal sensitive data this way because normal users can access the Application sandbox directory with read and write permissions.
Similar scripts exist in XCSSET for stealing sensitive data from other apps: Contacts, Evernote, Notes, Opera, Skype, WeChat.
Trend Micro researchers say that the latest version of XCSSET they analyzed also has an updated list of C2 servers and a new "Canary" module for cross-site scripting injections in the experimental Chrome Canary web browser.
XCSSET is targeting the latest macOS version and has been seen in the past leverage a zero-day vulnerability to circumvent protections for full disk access and avoid explicit content from the user.
News URL
Related news
- Google Chrome's AI-powered security feature rolls out to everyone (source)
- Google Chrome disables uBlock Origin for some in Manifest v3 rollout (source)
- XCSSET macOS malware returns with first new version since 2022 (source)
- Microsoft spots XCSSET macOS malware variant used for crypto theft (source)
- Microsoft Uncovers New XCSSET macOS Malware Variant with Advanced Obfuscation Tactics (source)
- The XCSSET info-stealing malware is back, targeting macOS users and devs (source)
- New FrigidStealer Malware Targets macOS Users via Fake Browser Updates (source)
- SpyLend Android malware downloaded 100,000 times from Google Play (source)
- Google Cuts Off uBlock Origin on Chrome as Firefox Stands Firm on Ad Blockers (source)
- Seven Malicious Go Packages Found Deploying Malware on Linux and macOS Systems (source)