{"id":1216771,"date":"2025-02-18T16:04:55","date_gmt":"2025-02-18T21:04:55","guid":{"rendered":"https:\/\/www.prime-wow.com\/?p=1216771"},"modified":"2025-02-18T16:04:55","modified_gmt":"2025-02-18T21:04:55","slug":"microsoft-warns-that-the-powerful-xcsset-macos-malware-is-back-with-new-tricks","status":"publish","type":"post","link":"https:\/\/www.prime-wow.com\/?p=1216771","title":{"rendered":"Microsoft warns that the powerful XCSSET macOS malware is back with new tricks"},"content":{"rendered":"<div>\n<p>Microsoft said it has detected a new variant of XCSSET, a powerful macOS malware family that has targeted developers and users since at least 2020.<\/p>\n<p>The variant, which Microsoft <a href=\"https:\/\/x.com\/MsftSecIntel\/status\/1891410993265123662\">reported Monday<\/a>, marked the first publicly known update to the malware since 2022. The malware first came to light in 2020, when security firm Trend Micro <a href=\"https:\/\/documents.trendmicro.com\/assets\/pdf\/XCSSET_Technical_Brief.pdf\">said<\/a> it had targeted app developers after spreading through a publicly available project the attacker wrote for Xcode, a developer tool Apple makes freely available. The malware gained immediate attention because it exploited what, at the time, were two zero-day vulnerabilities, a testament to the resourcefulness of the entity behind the attacks.<\/p>\n<p>In 2021, XCSSET surfaced again, first when it was used to <a href=\"https:\/\/arstechnica.com\/gadgets\/2021\/03\/attackers-are-trying-awfully-hard-to-backdoor-ios-developers-macs\/\">backdoor developers\u2019 devices<\/a> and a few months later when researchers found it <a href=\"https:\/\/arstechnica.com\/gadgets\/2021\/05\/hackers-exploit-a-macos-0day-that-allows-them-to-screenshot-infected-macs\/\">exploiting<\/a> what at the time was a new zero-day.<\/p>\n<p><a href=\"https:\/\/arstechnica.com\/security\/2025\/02\/microsoft-warns-that-the-powerful-xcsset-macos-malware-is-back-with-new-tricks\/\">Read full article<\/a><\/p>\n<p><a href=\"https:\/\/arstechnica.com\/security\/2025\/02\/microsoft-warns-that-the-powerful-xcsset-macos-malware-is-back-with-new-tricks\/#comments\">Comments<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft said it has detected a new variant of XCSSET, a powerful macOS malware family that has targeted developers and users since at least 2020. The variant, which Microsoft reported Monday, marked the first publicly known update to the malware &hellip; <a href=\"https:\/\/www.prime-wow.com\/?p=1216771\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[27,44],"tags":[],"class_list":["post-1216771","post","type-post","status-publish","format-standard","hentry","category-ars-technica","category-technology"],"_links":{"self":[{"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/posts\/1216771","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1216771"}],"version-history":[{"count":0,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=\/wp\/v2\/posts\/1216771\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1216771"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1216771"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.prime-wow.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1216771"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}