Threat intelligence / Malware

XCSSET

[XCSSET](https://attack.mitre.org/software/S0658) is a modular macOS malware family delivered through infected Xcode projects and executed when the project is compiled. Active since August 2020, it has been observed installing backdoors, spoofed browsers, collecting data, and encrypting user files. It is composed of SHC-compiled shell scripts and run-only AppleScripts, often hiding in apps that mimic system tools (such as Xcode, Mail, or Notes) or use familiar icons (like Launchpad) to avoid detection.(Citation: trendmicro xcsset xcode project 2020)(Citation: April 2021 TrendMicro XCSSET)(Citation: Microsoft March 2025 XCSSET)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[XCSSET](https://attack.mitre.org/software/S0658) is a modular macOS malware family delivered through infected Xcode projects and executed when the project is compiled. Active since August 2020, it has been observed installing backdoors, spoofed browsers, collecting data, and encrypting user files. It is composed of SHC-compiled shell scripts and run-only AppleScripts, often hiding in apps that mimic system tools (such as Xcode, Mail, or Notes) or use familiar icons (like Launchpad) to avoid detection.(Citation: trendmicro xcsset xcode project 2020)(Citation: April 2021 TrendMicro XCSSET)(Citation: Microsoft March 2025 XCSSET)

Labels

malware

33 recorded

Relationships

uses

to Account Discovery

Technique

uses

to Archive Collected Data

Technique

uses

to Compromise Host Software Binary

Technique

uses

to Compromise Software Dependencies and Development Tools

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Data from Local System

Technique

uses

to Dynamic Linker Hijacking

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Event Triggered Execution

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to File and Directory Discovery

Technique

uses

to Gatekeeper Bypass

Technique

uses

to GUI Input Capture

Technique

uses

to Hidden Files and Directories

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Launch Daemon

Technique

uses

to Linux and Mac Permissions

Technique

uses

to Masquerading

Technique

uses

to Plist File Modification

Technique

uses

to Screen Capture

Technique

uses

to Security Software Discovery

Technique

uses

to Software Discovery

Technique

uses

to SSH Authorized Keys

Technique

uses

to Steal Web Session Cookie

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to TCC Manipulation

Technique

uses

to Time Based Checks

Technique

uses

Technique

uses

to Unix Shell Configuration Modification

Technique

7 external

References

mitre-attack

S0658

OSX.DubRobber

—

XCSSET

—

trendmicro xcsset xcode project 2020

https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf

Microsoft March 2025 XCSSET

https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/

April 2021 TrendMicro XCSSET

https://www.trendmicro.com/en_us/research/21/d/xcsset-quickly-adapts-to-macos-11-and-m1-based-macs.html

malwarebyteslabs xcsset dubrobber

https://blog.malwarebytes.com/detections/osx-dubrobber/