In August of 2020, Trend Micro researchers spotted malware that spread through the Xcode projects and targeted systems to steal sensitive information and launch ransomware attacks. Applications like Evernote, QQ, skype, WeChat, Notes, and Telegram were infected by the malware. The malware allowed attackers to exfiltrate stolen documents from targeted systems and capture screenshots. It was also able to implement ransomware behavior by encrypting files and displaying ransomware notes.
While Trend Micro discovered two Xcode projects injected with the XCSSET Mac Malware in 2020, Kaspersky has discovered a new variant of the malware compiled for devices with M1 chips.
“While exploring the various executable modules of XCSSET, we found out that some of them also contained samples compiled specially for new Apple Silicon chips. For example, a sample with the MD5 hash sum 914e49921c19fffd7443deee6ee161a4 contains two architectures: x86_64 and ARM64.” states the report published by Kaspersky.
“The first one corresponds to previous-generation, Intel-based Mac computers, but the second one is compiled for ARM64 architecture, which means that it can run on computers with the new Apple M1 chip.”
The XCSSET Mac Malware now supports both x86_x64 and ARM64 architectures, and in addition to M1 chips, XCSSET malware also fits with macOS 11 Big Sur.
ARM-based M1 processors