New Mac Malware Targets Crypto Wallets and Notes App

Microsoft Warns of Updated XCSSET Malware

If you use a Mac, you might want to pay attention. Microsoft researchers have identified a new version of the XCSSET malware, originally discovered in 2020, which now includes more dangerous capabilities.

What Can This Malware Do?

Steals Sensitive Data – Can access and extract data from Telegram and Apple’s Notes app.
Records User Activity – Takes screenshots and tracks user actions.
Modifies Browser Behavior – Can replace cryptocurrency wallet addresses in browsers, redirecting transactions to hackers.
Encrypts Files – Suggests potential use in ransomware attacks.
Hides From Detection – Uses advanced obfuscation techniques to avoid security scans.
Persists on macOS – Reloads every time the Launchpad is opened from the macOS dock.

How Does It Spread?

XCSSET mainly infects developers through compromised Xcode projects—the files used to build macOS apps. If you download or clone infected projects, your system could be compromised.

Who Is at Risk?

Initially, XCSSET seemed to target developers, but its expanded capabilities mean everyday Mac users could also be vulnerable, especially those who handle cryptocurrency.

Microsoft Threat Intelligence has uncovered a new variant of XCSSET, a sophisticated modular macOS malware that targets users by infecting Xcode projects, in the wild. While we’re only seeing this new XCSSET variant in limited attacks at this time, we’re sharing this information… pic.twitter.com/oWfsIKxBzB
— Microsoft Threat Intelligence (@MsftSecIntel) February 17, 2025

How to Stay Safe

Verify Xcode Projects – Only download from trusted sources.
Use Official App Stores – Install software from Apple’s App Store or official platforms.
Enable Security Tools – Microsoft Defender for Endpoint on Mac can detect this malware.
Be Cautious with Crypto Transactions – Double-check wallet addresses before sending funds.
Regularly Update macOS – Keeping your system updated helps protect against malware exploits.

Ransomware Landscape Is Changing

Meanwhile, ransomware attacks are evolving. Blockchain analytics firm Chainalysis reports that ransom payments dropped by 35% in 2024 due to law enforcement actions and victims refusing to pay. However, hackers are adapting, releasing new ransomware strains and demanding payments within hours of encrypting files.